Description

Subscriber Privilege Escalation in MasterStudy LMS <= 3.7.41 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-18T15:17:00.653Z",
  "pubdate": "2026-08-18T15:17:00.653Z",
  "executiveSummary": "A privilege escalation vulnerability has been identified in MasterStudy LMS versions 3.7.41 and prior. The security flaw allows authenticated users assigned the low-privileged Subscriber role to improperly elevate their access rights within the application. The primary impact of this vulnerability is the unauthorized acquisition of higher-level administrative privileges, which compromises the integrity, confidentiality, and availability of the affected WordPress site.\nThe vulnerability exposes systems running the MasterStudy LMS plugin to malicious actors who possess basic, low-privileged user accounts. Attackers capable of authenticating as a Subscriber can exploit inadequate authorization controls and insecure function handling during request processing. Successful exploitation requires network access to the target application and an active low-privileged session, bypassing intended role-based access control boundaries without requiring complex preconditions or user interaction from high-privileged administrators.\nThe risk implication is severe, as an attacker with escalated privileges can execute administrative actions, modify system configurations, inject malicious code or scripts, and compromise underlying database assets. Organizations utilizing vulnerable versions of MasterStudy LMS face a critical exposure window until remediation measures are successfully implemented.",
  "technicalDetails": "The vulnerability resides within the authorization and request handling logic of the MasterStudy LMS plugin affecting versions 3.7.41 and prior. The root cause stems from insufficient privilege verification checks when processing specific function calls or AJAX/REST API endpoints exposed by the plugin. Specifically, the application fails to adequately validate whether the authenticated user context possessing a Subscriber role holds the necessary capabilities to execute privileged state-changing operations.\nExploitation of this vulnerability requires network access to the target WordPress installation and a valid user session authenticated with minimal privileges, specifically the Subscriber role. The attack flow initiates when the malicious actor crafts a specialized HTTP request targeting vulnerable backend components or functions within MasterStudy LMS. Because the underlying codebase lacks robust capability checks (such as missing current_user_can() validations or improper nonce verifications tied to administrative roles), the application improperly honors the incoming request.\nDuring payload execution, the vulnerable component processes the unauthorized parameters submitted by the low-privileged user, resulting in the modification of user metadata, role assignments, or direct capability grants. Consequently, the attacker account is appended with administrator-level capabilities or reassigned to the Administrator role within the WordPress database. Post-exploitation impact includes full administrative takeover of the WordPress instance, allowing the adversary to install arbitrary plugins, upload webshells, access sensitive user data, and pivot further into the hosting environment."
}