MasterStudy LMS lets visitors manipulate user state
MasterStudy LMS through 3.7.39 insufficiently verifies the authenticity of data used to change LMS user state. The advisory classifies the path as unauthenticated, so a visitor can trigger the state-manipulation behavior without a WordPress account.
- Component
- MasterStudy LMS
- Plugin slug
masterstudy-lms-learning-management-system- Affected
- n/a through 3.7.39
- Safe version
3.7.40- Published
- Jul 31, 2026
This CVE was published Jul 31, 2026 and is one of 31 known issues for this plugin.
Update, patch or deactivate.
Update MasterStudy LMS to 3.7.40 or later. Review unauthenticated LMS activity and user-state changes made while a vulnerable release was active, restore unexplained changes from trusted records where practical, and investigate affected accounts if state manipulation is identified.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
Insufficient Verification of Data Authenticity vulnerability in StylemixThemes MasterStudy LMS allows Manipulating User State. This issue affects MasterStudy LMS: from n/a through 3.7.39.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N