CVE-2026-88845

Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress Plugin versions prior to 3.7.50

Description An issue exists where the plugin fails to perform capability or nonce checks on an administrative maintenance action. A nonce is a unique token used to protect against cross-site request forgery. This flaw allows any authenticated user, including those with subscriber-level privileges, to trigger the action and create published content on the site attributed to their own account.

Recommendations Update MasterStudy LMS WordPress Plugin to version 3.7.50 or later.