CVE-2026-88848

Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress plugin versions 1.9 through 3.7.49

Description Insufficient verification occurs when a member requests enrollment in a course. The plugin fails to confirm if the requested course is included in the user's membership plan or if the submitted plan identifier is actually held by the user. This allows members to enroll in restricted paid courses that are not part of their plan or exceed the number of courses permitted by their membership.

Recommendations Update MasterStudy LMS WordPress plugin to version 3.7.50 or later.