CVE-2026-88843

Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress Plugin versions prior to 3.7.50

Description Insufficient validation of a display-style setting allows users with the Contributor role and above to perform Local File Inclusion (LFI), which is a technique used to trick an application into including files from the local file system. This flaw enables the inclusion and execution of arbitrary local PHP files on the server via the Elementor Courses Categories Widget.

Recommendations Update MasterStudy LMS WordPress Plugin to version 3.7.50 or later.