CVE-2026-88848: MasterStudy LMS Auth Bypass Vulnerability

CVE-2026-88848 Overview

CVE-2026-88848 is a broken access control vulnerability in the MasterStudy LMS WordPress plugin affecting versions 1.9 through 3.7.49. The plugin fails to verify that a course a member attempts to enrol in is covered by their active membership plan. It also does not validate that the plan identifier submitted with the enrolment request belongs to the requesting user. Any authenticated member can enrol in restricted paid courses outside their plan and exceed the course quota their plan entitles them to. The flaw is categorized under CWE-863: Incorrect Authorization.

Critical Impact
Authenticated members can bypass membership plan restrictions to access paid courses they have not purchased, resulting in revenue loss for learning platforms.

Affected Products

MasterStudy LMS WordPress plugin versions 1.9 through 3.7.49
WordPress sites running MasterStudy LMS with membership plan features enabled
Learning management deployments offering tiered paid course access

Discovery Timeline

2026-09-25 - CVE CVE-2026-88848 published to NVD
2026-09-25 - Last updated in NVD database

Technical Details for CVE-2026-88848

Vulnerability Analysis

The vulnerability is a business logic flaw in the course enrolment workflow of MasterStudy LMS. When a member requests to enrol in a course, the plugin processes the request without validating two authorization conditions. First, it does not check whether the target course belongs to the member's active plan. Second, it does not verify that the plan identifier submitted in the request is one the member actually holds.

The missing authorization checks allow an attacker to tamper with the enrolment request parameters. Submitting an arbitrary plan identifier is sufficient to bypass the entitlement logic. This also allows members to exceed the course quota defined by their legitimate plan.

The impact is limited to confidentiality and integrity of enrolment data. There is no direct impact on availability or on the underlying WordPress host.

Root Cause

The plugin relies on client-supplied plan identifiers without server-side ownership verification. The enrolment handler trusts the submitted parameters and does not cross-check them against the authenticated user's purchased plans or the plan-to-course mapping stored on the server.

Attack Vector

Exploitation requires an authenticated session on a vulnerable WordPress site with MasterStudy LMS installed. The attacker intercepts or crafts an enrolment HTTP request and substitutes the plan identifier or course identifier with values they are not entitled to. The request is sent over the network to the plugin's enrolment endpoint. No user interaction from other users is required. See the WPScan Vulnerability Report for additional technical details.

Detection Methods for CVE-2026-88848

Indicators of Compromise

Enrolment records associating users with courses that are not part of their purchased membership plan.
Members with course counts exceeding the quota defined by their active plan.
HTTP POST requests to MasterStudy LMS enrolment endpoints containing plan identifiers not owned by the authenticated user.

Detection Strategies

Audit the WordPress database for enrolment rows that violate plan-to-course mappings.
Review web server access logs for repeated enrolment requests from the same account targeting multiple courses in a short window.
Correlate membership purchase records against active enrolments to identify discrepancies.

Monitoring Recommendations

Alert on anomalous spikes in course enrolment volume per user account.
Monitor WordPress admin logs for unexpected changes in user-to-course associations.
Enable WordPress audit logging plugins to capture enrolment API calls with full request parameters.

How to Mitigate CVE-2026-88848

Immediate Actions Required

Upgrade the MasterStudy LMS plugin to version 3.7.50 or later on all WordPress sites.
Audit existing enrolments to identify and revoke unauthorized course access granted before patching.
Reconcile membership plan records with active enrolments and refund or correct discrepancies as needed.

Patch Information

The vendor addressed the issue in MasterStudy LMS version 3.7.50. Administrators should update through the WordPress plugin manager or by replacing the plugin files with the patched release. Verify the installed version under the WordPress Plugins page after upgrading.

Workarounds

Temporarily disable the membership plan enrolment functionality until the plugin can be updated.
Restrict access to the WordPress site to trusted member accounts and remove unused test accounts.
Apply Web Application Firewall rules that validate plan_id parameters against the authenticated user's session where feasible.

bash

# Verify installed MasterStudy LMS version via WP-CLI
wp plugin get masterstudy-lms-learning-management-system --field=version

# Update MasterStudy LMS to the patched release
wp plugin update masterstudy-lms-learning-management-system --version=3.7.50