CVE-2026-88847: MasterStudy LMS Auth Bypass Vulnerability

CVE-2026-88847 Overview

CVE-2026-88847 is a missing authorization vulnerability [CWE-862] in the MasterStudy LMS WordPress plugin before version 3.7.50. The plugin fails to verify enrollment status before recording lesson completions against a course. Any authenticated user, including a low-privileged subscriber, can create course progress records for courses they do not have access to. The flaw affects the integrity of learning management data without exposing confidential information or disrupting availability.

Critical Impact

Authenticated subscribers can forge lesson completion records for courses they are not enrolled in, corrupting learner progress data and course analytics across affected WordPress sites.

Affected Products

• MasterStudy LMS WordPress Plugin versions prior to 3.7.50
• WordPress sites running the vulnerable plugin with open user registration
• Learning platforms relying on MasterStudy LMS for course progress tracking

Discovery Timeline

• 2026-09-24 - CVE CVE-2026-88847 published to NVD
• 2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-88847

Vulnerability Analysis

The MasterStudy LMS plugin exposes an endpoint that records lesson completion events for authenticated users. The handler accepts a course identifier and lesson identifier from the request and writes a progress record without checking whether the calling user is enrolled in the referenced course. The authorization check that should gate the write operation is absent, which is characteristic of CWE-862 Missing Authorization.

Because the only requirement is a valid authenticated session, any registered account can invoke the endpoint. On sites that permit self-registration at the subscriber role, this results in an effectively open path for progress forgery. The impact is confined to data integrity for the LMS progress tables and dependent analytics.

Root Cause

The root cause is the absence of an enrollment verification check inside the lesson completion handler. The code trusts the authenticated user's claimed course context rather than validating it against the enrollment table before executing the database insert.

Attack Vector

Exploitation is network-based and requires low privileges. An attacker registers or uses an existing subscriber account, authenticates to the target WordPress site, and sends crafted requests to the lesson completion endpoint with arbitrary course_id and lesson_id parameters. The server records completion events against the attacker's user ID for courses the attacker never purchased or enrolled in. See the WPScan Vulnerability Report for additional technical context.

No verified proof-of-concept code is published. The vulnerability mechanism is described in prose because no sanitized exploit sample is available from upstream sources.

Detection Methods for CVE-2026-88847

Indicators of Compromise

• Lesson completion records attributed to users with no matching entry in the enrollment or order tables.
• Spikes in admin-ajax.php or REST API calls targeting MasterStudy lesson progress endpoints from subscriber accounts.
• Course progress analytics showing anomalous completion rates from newly registered accounts.

Detection Strategies

• Query the LMS progress tables and join against enrollment records to surface completions by non-enrolled users.
• Review web server logs for repeated POST requests to MasterStudy lesson completion routes from a single authenticated session.
• Correlate account creation timestamps with immediate bursts of lesson completion activity.

Monitoring Recommendations

• Alert on authenticated low-privilege accounts generating high volumes of LMS state-changing requests.
• Track MasterStudy plugin version across managed WordPress sites and flag installations below 3.7.50.
• Monitor WordPress audit logs for user role and progress table changes outside normal enrollment workflows.

How to Mitigate CVE-2026-88847

Immediate Actions Required

• Upgrade MasterStudy LMS to version 3.7.50 or later on all affected WordPress sites.
• Audit existing lesson completion records and remove entries that do not correspond to valid enrollments.
• Review new subscriber registrations created in the window preceding the patch for suspicious activity.

Patch Information

The vendor addressed the issue in MasterStudy LMS version 3.7.50 by adding the missing enrollment verification before recording lesson completions. Site administrators should apply the update through the WordPress plugin manager or by replacing the plugin files with the patched release. Reference the WPScan Vulnerability Report for advisory details.

Workarounds

• Disable the MasterStudy LMS plugin on sites that cannot immediately apply the patch.
• Restrict new user registration or require administrator approval to limit the pool of accounts able to invoke the endpoint.
• Deploy a web application firewall rule to block POST requests to MasterStudy lesson completion routes from accounts lacking matching enrollment records.