WordPress plugin · masterstudy-lms-learning-management-system
Is MasterStudy LMS WordPress Plugin safe?
Safe on 3.7.56 or newer.
The current version, 3.7.56, is past every affected range on record (50 of 52 records list one; 2 don’t, so check those below). Keep it updated and you’re clear of them.
- Flaws on record
- 52
- High or critical
- 14
- Exploited
- none
- Current version
- 3.7.56
- Last updated
- Oct 27, 2026
- Active installs
- 10,000+
Every recorded flaw
- Oct 22, 2026MasterStudy LMS: Does not verify that a user targeted through its student-enrolment feature has any relationship to the requesting instructorCVE-2026-88849 · fixed in 3.7.55 · reported by WPScanLow 2.7
- Oct 8, 2026MasterStudy LMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105079 · affects up to 3.7.52 · reported by PatchstackMedium 6.5
- Sep 24, 2026MasterStudy LMS: Does not verify that a user is enrolled in a course before recording lesson completions against itCVE-2026-88847 · fixed in 3.7.50 · reported by WPScanMedium 4.3
- Sep 24, 2026MasterStudy LMS: Does not check whether user registration is enabled on the site before creating an account through one of its front-end registration flowsCVE-2026-88846 · fixed in 3.7.50 · reported by WPScanMedium 5.3
- Sep 24, 2026MasterStudy LMS: Does not perform any capability or nonce checks on an administrative maintenance actionCVE-2026-88845 · fixed in 3.7.50 · reported by WPScanMedium 4.3
- Sep 24, 2026MasterStudy LMS: Does not validate one of its display-style settings before using it to build a template pathCVE-2026-88843 · fixed in 3.7.50 · reported by WPScanHigh 7.2
- Sep 23, 2026MasterStudy LMS: Does not perform a per-object ownership checkCVE-2026-81339 · fixed in 3.7.50 · reported by WPScanMedium 4.3
- Sep 23, 2026MasterStudy LMS: Does not properly sanitise and restrict HTML in user-submitted content before storing it and rendering it to other usersCVE-2026-81338 · fixed in 3.7.50 · reported by WPScanMedium 4.6
- Sep 18, 2026MasterStudy LMS: Does not verify that the requesting user owns the course before returning its enrolled-student dataCVE-2026-88844 · fixed in 3.7.50 · reported by WPScanLow 2.7
- Sep 18, 2026MasterStudy LMS: Does not perform per-object ownership or capability checksCVE-2026-81340 · fixed in 3.7.50 · reported by WPScanLow 3.8
- Sep 2, 2026MasterStudy LMS: Does not perform an authorization check before returning a student's learning statisticsCVE-2026-81199 · fixed in 3.7.46 · reported by WPScanMedium 5.3
- Sep 2, 2026MasterStudy LMS: Does not properly verify ownership of a curriculum object before acting on itCVE-2026-81198 · fixed in 3.7.46 · reported by WPScanLow 3.8
- Sep 2, 2026MasterStudy LMS: Does not restrict access to a REST route that lists an author's coursesCVE-2026-81197 · fixed in 3.7.46 · reported by WPScanMedium 5.3
- Sep 2, 2026MasterStudy LMS: Does not properly verify ownership of quiz question identifiersCVE-2026-81196 · fixed in 3.7.46 · reported by WPScanLow 2.7
- Sep 2, 2026MasterStudy LMS: Does not perform an authorization check before returning per-student course enrollment and progress dataCVE-2026-81195 · fixed in 3.7.46 · reported by WPScanMedium 5.3
- Sep 2, 2026MasterStudy LMS: Does not properly verify authorizationCVE-2026-81194 · fixed in 3.7.46 · reported by WPScanMedium 4.3
- Aug 29, 2026MasterStudy LMS: Does not validate a redirect parameter supplied during user registration before using itCVE-2026-81342 · fixed in 3.7.43 · reported by WPScanMedium 4.7
- Aug 29, 2026MasterStudy LMS: Does not correctly restrict access to order informationCVE-2026-81200 · fixed in 3.7.42 · reported by WPScanLow 2.7
- Aug 29, 2026MasterStudy LMS: Does not verify the amountCVE-2026-81026 · fixed in 3.7.40 · reported by WPScanMedium 4.8
- Aug 24, 2026Unauthenticated Arbitrary File Deletion in MasterStudy LMS <= 3.7.42 versions.CVE-2026-78284 · affects up to 3.7.42 · reported by PatchstackHigh 8.6
- Aug 18, 2026Subscriber Broken Access Control in MasterStudy LMS <= 3.7.41 versions.CVE-2026-73404 · affects up to 3.7.41 · reported by PatchstackMedium 6.5
- Aug 18, 2026Subscriber Privilege Escalation in MasterStudy LMS <= 3.7.41 versions.CVE-2026-68568 · affects up to 3.7.41 · reported by PatchstackMedium 6.3
- Jul 31, 2026MasterStudy LMS: Insufficient Verification of Data AuthenticityCVE-2026-28145 · affects up to 3.7.39 · reported by PatchstackMedium 5.3
- Jul 29, 2026MasterStudy LMS WordPress Plugin – for Online Courses and Education: Insecure Direct Object ReferenceCVE-2026-5060 · affects up to 3.7.14 · reported by WordfenceMedium 6.5
- Jun 29, 2026Subscriber Cross Site Scripting (XSS) in MasterStudy LMS <= 3.7.27 versions.CVE-2026-57330 · reported by PatchstackMedium 6.5
- Jun 26, 2026Subscriber Broken Access Control in MasterStudy LMS <= 3.7.30 versions.CVE-2026-57640 · reported by PatchstackMedium 4.3
- Jun 15, 2026Subscriber SQL Injection in MasterStudy LMS <= 3.7.25 versions.CVE-2026-40766 · affects up to 3.7.25 · reported by PatchstackHigh 8.5
- May 27, 2026MasterStudy LMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42730 · affects up to 3.7.29 · reported by PatchstackHigh 8.5
- Apr 16, 2026MasterStudy LMS WordPress Plugin for Online Courses and Education: Time-based Blind SQL InjectionCVE-2026-4817 · affects up to 3.7.25 · reported by WordfenceMedium 6.5
- Feb 14, 2026MasterStudy LMS WordPress Plugin – for Online Courses and Education: Stored Cross-Site ScriptingCVE-2026-0559 · affects up to 3.7.11 · reported by WordfenceMedium 6.4
- Jan 6, 2026MasterStudy LMS WordPress Plugin – for Online Courses and Education: Unauthorized modification and deletion of dataCVE-2025-13766 · affects up to 3.7.6 · reported by WordfenceMedium 5.4
- Oct 31, 2025MasterStudy LMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-64366 · affects up to 3.6.27 · reported by PatchstackHigh 7.6
- Oct 22, 2025MasterStudy LMS: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-59575 · affects up to 3.6.20 · reported by PatchstackMedium 4.9
- Sep 22, 2025MasterStudy LMS: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')CVE-2025-59577 · affects up to 3.6.20 · reported by PatchstackMedium 4.3
- Sep 22, 2025MasterStudy LMS: Missing AuthorizationCVE-2025-59576 · affects up to 3.6.20 · reported by PatchstackMedium 6.5
- Sep 5, 2025MasterStudy LMS: Missing AuthorizationCVE-2025-54744 · affects up to 3.6.15 · reported by PatchstackMedium 6.5
- Apr 4, 2025MasterStudy LMS: Missing AuthorizationCVE-2025-32237 · affects up to 3.5.28 · reported by PatchstackMedium 4.3
- Apr 4, 2025MasterStudy LMS: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32141 · affects up to 3.5.28 · reported by PatchstackHigh 8.8
- Jan 2, 2025MasterStudy LMS: Cross-Site Request Forgery (CSRF)CVE-2024-37093 · affects up to 3.2.1 · reported by PatchstackMedium 4.3
- Nov 1, 2024MasterStudy LMS: Missing AuthorizationCVE-2024-37094 · affects up to 3.2.12 · reported by PatchstackHigh 8.2
- Jul 22, 2024MasterStudy LMS: Does not prevent students from creating instructor accountsCVE-2024-5973 · fixed in 3.3.24 · reported by WPScanHigh 8.8
- May 2, 2024MasterStudy LMS WordPress Plugin – for Online Courses and Education: Unauthorized access, modification, and loss of dataCVE-2024-3942 · affects up to 3.3.8 · reported by WordfenceMedium 6.3
- Apr 9, 2024MasterStudy LMS: Local File InclusionCVE-2024-3136 · affects up to 3.3.3 · reported by Wordfence5.0% oddsCritical 9.8
- Apr 9, 2024MasterStudy LMS: Unauthorized access of dataCVE-2024-1904 · affects up to 3.2.13 · reported by WordfenceMedium 4.3
- Mar 29, 2024MasterStudy LMS: Local File InclusionCVE-2024-2411 · affects up to 3.3.0 · reported by Wordfence1.5% oddsCritical 9.8
- Mar 29, 2024MasterStudy LMS: Privilege EscalationCVE-2024-2409 · affects up to 3.3.1 · reported by WordfenceCritical 9.8
- Mar 13, 2024MasterStudy LMS WordPress Plugin – for Online Courses and Education: Information ExposureCVE-2024-2106 · affects up to 3.2.10 · reported by WordfenceMedium 5.3
- Feb 17, 2024MasterStudy LMS WordPress Plugin – for Online Courses and Education: Union based SQL InjectionCVE-2024-1512 · affects up to 3.2.5 · reported by Wordfence78% oddsCritical 9.8
- Sep 11, 2023MasterStudy LMS: Does not have proper checks in place during registration allowing anyone to register on the siteCVE-2023-4278 · fixed in 3.0.18 · reported by WPScan6.2% oddsHigh 7.5
- Jun 22, 2023Broken Access Control vulnerability in StylemixThemes MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin <= 3.0.8 versions allows any loCVE-2023-35093 · affects up to 3.0.8 · reported by PatchstackMedium 6.5
- Jun 22, 2023Auth.CVE-2023-35090 · affects up to 3.0.7 · reported by PatchstackMedium 6.5
- Mar 7, 2022MasterStudy LMS: Does to validate some parameters givenCVE-2022-0441 · fixed in 2.7.6 · reported by WPScan85% oddsCritical 9.8
Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Get in touch
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
Not ready to talk yet? Run the free website check and see what Google sees.