Arman Kumar

**Name of the Vulnerable Software and Affected Versions** MasterStudy LMS WordPress plugin versions 1.9 through 3.7.49 **Description** Insufficient verification occurs when a member requests enrollment in a course. The plugin fails to confirm if the requested course is included in the user's membership plan or if the submitted plan identifier is actually held by the user. This allows members to enroll in restricted paid courses that are not part of their plan or exceed the number of courses permitted by their membership. **Recommendations** Update MasterStudy LMS WordPress plugin to version 3.7.50 or later.

**Name of the Vulnerable Software and Affected Versions** MasterStudy LMS WordPress Plugin versions prior to 3.7.50 **Description** An issue exists where the plugin fails to verify if a user is enrolled in a course before recording lesson completions. This allows any authenticated user, including those with subscriber privileges, to create course progress records for courses to which they have no authorized access. **Recommendations** Update MasterStudy LMS WordPress Plugin to version 3.7.50 or later.