EN ES
Start free
Menu

MasterStudy LMS WordPress Plugin: known security problems

55 known security problems reported for this WordPress plugin, with the affected versions, the fix and what to do.

Updated

In short

There are 55 known security problems on this page. Each one has a fixed version. Updating to version 3.7.55 or newer covers every fixed problem listed here.

Based on public reports. Check the plugin’s changelog. Watchfox AI may be wrong.

Get an email when your site is affected: install Watchfox AI (free)

This week

Someone could do things on your site they should not be allowed to (from 3.7.13 up to and including 3.7.54)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 3.7.13 up to and including 3.7.54
Fixed in
3.7.55
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.7.55 or newer.
Official ID
CVE-2026-88849
Report title
MasterStudy LMS WordPress Plugin – for Online Courses and Education 3.7.13 - 3.7.54 - Missing Authorization
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.7.52)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.7.52
Fixed in
3.7.53
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.7.53 or newer.
Official ID
CVE-2026-105079
Report title
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.52 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could read or delete private files on your server (from 3.5.29 up to and including 3.7.49)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 3.5.29 up to and including 3.7.49
Fixed in
3.7.50
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.7.50 or newer.
Official ID
CVE-2026-88843
Report title
MasterStudy LMS 3.5.29 - 3.7.49 - Authenticated (Contributor+) Local File Inclusion
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 3.7.49)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.7.49
Fixed in
3.7.50
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.7.50 or newer.
Official ID
CVE-2026-88845
Report title
MasterStudy LMS <= 3.7.49 - Missing Authorization
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 3.7.49) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.7.49
Fixed in
3.7.50
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.7.50 or newer.
Official ID
CVE-2026-88846
Report title
MasterStudy LMS <= 3.7.49 - Missing Authorization to Account Registration
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 3.7.49) (3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.7.49
Fixed in
3.7.50
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.7.50 or newer.
Official ID
CVE-2026-88847
Report title
MasterStudy LMS <= 3.7.49 - Missing Authorization
First reported
Sources
This week

A stranger could use it to harm your site (up to and including 3.7.49)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.7.49
Fixed in
3.7.50
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.7.50 or newer.
Official ID
CVE-2026-88848
Report title
MasterStudy LMS <= 3.7.49 - Unauthenticated (Subscriber+) Unauthorized Course Enrollment
First reported
Sources
This week

Anyone with an account on your site, even a basic one could use it to harm your site (up to and including 3.7.49)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.7.49
Fixed in
3.7.50
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.7.50 or newer.
Official ID
CVE-2026-81339
Report title
MasterStudy LMS <= 3.7.49 - Authenticated (Subscriber+) Insecure Direct Object Reference
First reported
Sources
This week

Anyone with an account on your site, even a basic one could use it to harm your site (up to and including 3.7.49) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.7.49
Fixed in
3.7.50
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.7.50 or newer.
Official ID
CVE-2026-81338
Report title
MasterStudy LMS <= 3.7.49 - Authenticated (Subscriber+) HTML Injection
First reported
Sources
This week

Someone could use it to harm your site (up to and including 3.7.49)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.7.49
Fixed in
3.7.50
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.7.50 or newer.
Official ID
CVE-2026-88844
Report title
MasterStudy LMS <= 3.7.49 - Authenticated (Instructor+) Insecure Direct Object Reference
First reported
Sources
This week

Someone could use it to harm your site (up to and including 3.7.49) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.7.49
Fixed in
3.7.50
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.7.50 or newer.
Official ID
CVE-2026-81340
Report title
MasterStudy LMS <= 3.7.49 - Authenticated (Instructor+) Insecure Direct Object Reference
First reported
Sources
This week

Anyone with an account on your site, even a basic one could use it to harm your site (before 3.7.46)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.7.46
Fixed in
3.7.46
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.7.46 or newer.
Official ID
CVE-2026-81194
Report title
MasterStudy LMS WordPress Plugin – for Online Courses and Education < 3.7.46 - Authenticated (Subscriber+) Insecure Direct Object Reference
First reported
Sources
This week

A stranger could use it to harm your site (before 3.7.46)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.7.46
Fixed in
3.7.46
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.7.46 or newer.
Official ID
CVE-2026-81199
Report title
MasterStudy LMS WordPress Plugin – for Online Courses and Education < 3.7.46 - Unauthenticated Information Exposure
First reported
Sources
This week

Someone could use it to harm your site (before 3.7.46)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.7.46
Fixed in
3.7.46
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.7.46 or newer.
Official ID
CVE-2026-81196
Report title
MasterStudy LMS WordPress Plugin – for Online Courses and Education < 3.7.46 - Authenticated (Custom Role+) Insecure Direct Object Reference
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (before 3.7.46)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.7.46
Fixed in
3.7.46
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.7.46 or newer.
Official ID
CVE-2026-81195
Report title
MasterStudy LMS WordPress Plugin – for Online Courses and Education < 3.7.46 - Missing Authorization
First reported
Sources
This week

Someone could use it to harm your site (before 3.7.46) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.7.46
Fixed in
3.7.46
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.7.46 or newer.
Official ID
CVE-2026-81198
Report title
MasterStudy LMS WordPress Plugin – for Online Courses and Education < 3.7.46 - Authenticated (Custom Role+) Insecure Direct Object Reference
First reported
Sources
This week

A stranger could use it to harm your site (before 3.7.46) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.7.46
Fixed in
3.7.46
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.7.46 or newer.
Official ID
CVE-2026-81197
Report title
MasterStudy LMS WordPress Plugin – for Online Courses and Education < 3.7.46 - Unauthenticated Unpublished Course Data Exposure
First reported
Sources
This week

Someone could use it to harm your site (before 3.7.42)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.7.42
Fixed in
3.7.42
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.7.42 or newer.
Official ID
CVE-2026-81200
Report title
MasterStudy LMS WordPress Plugin – for Online Courses and Education < 3.7.42 - Authenticated (Custom Role+) Insecure Direct Object Reference
First reported
Sources
This week

A stranger could send your visitors from your site to a harmful site

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.7.43
Fixed in
3.7.43
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.7.43 or newer.
Official ID
CVE-2026-81342
Report title
MasterStudy LMS WordPress Plugin – for Online Courses and Education < 3.7.43 - Unauthenticated Open Redirect
First reported
Sources
This week

A stranger could use it to harm your site (before 3.7.40)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.7.40
Fixed in
3.7.40
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.7.40 or newer.
Official ID
CVE-2026-81026
Report title
MasterStudy LMS WordPress Plugin – for Online Courses and Education < 3.7.40 - Unauthenticated Payment Bypass
First reported
Sources
This week

A stranger could read or delete private files on your server (up to and including 3.7.42)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.7.42
Fixed in
3.7.43
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.7.43 or newer.
Official ID
CVE-2026-78284
Report title
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.42 - Unauthenticated Arbitrary File Deletion
First reported
Sources
This week

Anyone with an account on your site, even a basic one could take over your site as an admin

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.7.41
Fixed in
3.7.42
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.7.42 or newer.
Official ID
CVE-2026-68568
Report title
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.41 - Authenticated (Subscriber+) Privilege Escalation
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 3.7.41)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.7.41
Fixed in
3.7.42
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.7.42 or newer.
Official ID
CVE-2026-73404
Report title
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.41 - Missing Authorization
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 3.7.39)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.7.39
Fixed in
3.7.40
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.7.40 or newer.
Official ID
CVE-2026-28145
Report title
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.39 - Missing Authorization
First reported
Sources
This week

Someone could use it to harm your site (up to and including 3.7.23)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.7.23
Fixed in
3.7.24
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.7.24 or newer.
Official ID
CVE-2026-5060
Report title
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.14 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment Deletion
First reported
Sources
This week

Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.7.27
Fixed in
3.7.28
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.7.28 or newer.
Official ID
CVE-2026-57330
Report title
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.27 - Authenticated (Subscriber+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 3.7.30)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.7.30
Fixed in
3.7.31
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.7.31 or newer.
Official ID
CVE-2026-57640
Report title
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.30 - Missing Authorization
First reported
Sources
This week

Anyone with an account on your site, even a basic one could read or change the data in your site’s database (up to and including 3.7.29)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.7.29
Fixed in
3.7.30
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.7.30 or newer.
Official ID
CVE-2026-42730
Report title
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.29 - Authenticated (Subscriber+) SQL Injection
First reported
Sources
This week

Anyone with an account on your site, even a basic one could read or change the data in your site’s database (up to and including 3.7.25)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.7.25
Fixed in
3.7.26
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.7.26 or newer.
Official ID
CVE-2026-40766
Report title
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.25 - Authenticated (Subscriber+) SQL Injection
First reported
Sources
This week

Anyone with an account on your site, even a basic one could read or change the data in your site’s database (up to and including 3.7.25) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.7.25
Fixed in
3.7.26
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.7.26 or newer.
Official ID
CVE-2026-4817
Report title
MasterStudy LMS <= 3.7.25 - Authenticated (Subscriber+) Time-based Blind SQL Injection via 'order' and 'orderby' Parameters
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.7.11)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.7.11
Fixed in
3.7.12
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.7.12 or newer.
Official ID
CVE-2026-0559
Report title
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'stm_lms_courses_grid_display' Shortcode
First reported
Sources
This week

Anyone with an account on your site, even a basic one could do things on your site they should not be allowed to

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.7.6
Fixed in
3.7.7
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.7.7 or newer.
Official ID
CVE-2025-13766
Report title
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.6 Missing Authorization to Authenticated (Subscriber+) Posts and Media Creation, Modification and Deletion
First reported
Sources
This week

Someone could read or change the data in your site’s database

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.6.27
Fixed in
3.6.28
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.6.28 or newer.
Official ID
CVE-2025-64366
Report title
MasterStudy LMS <= 3.6.27 - Authenticated (Instructor+) SQL Injection
First reported
Sources
This week

Someone could see private information they should not see (up to and including 3.6.20)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.6.20
Fixed in
3.6.21
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.6.21 or newer.
Official ID
CVE-2025-59575
Report title
MasterStudy LMS <= 3.6.20 - Authenticated (Instructor+) Sensitive Information Exposure
First reported
Sources
This week

Anyone with an account on your site, even a basic one could use it to harm your site (up to and including 3.6.20)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.6.20
Fixed in
3.6.21
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.6.21 or newer.
Official ID
CVE-2025-59577
Report title
MasterStudy LMS <= 3.6.20 - Authenticated (Subscriber+) Race Condition to Multiple Reviews
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 3.6.20)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.6.20
Fixed in
3.6.21
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.6.21 or newer.
Official ID
CVE-2025-59576
Report title
MasterStudy LMS <= 3.6.20 - Missing Authorization
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 3.6.15)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.6.15
Fixed in
3.6.16
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.6.16 or newer.
Official ID
CVE-2025-54744
Report title
MasterStudy LMS <= 3.6.15 - Missing Authorization
First reported
Sources
This week

Someone with a contributor account on your site could read or delete private files on your server (up to and including 3.5.28)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.5.28
Fixed in
3.5.29
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.5.29 or newer.
Official ID
CVE-2025-32141
Report title
MasterStudy LMS <= 3.5.28 - Authenticated (Contributor+) Local File Inclusion
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 3.5.28)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.5.28
Fixed in
3.5.29
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.5.29 or newer.
Official ID
CVE-2025-32237
Report title
MasterStudy LMS <= 3.5.28 - Missing Authorization
First reported
Sources
This week

A stranger could take over your site as an admin (up to and including 3.3.23)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.3.23
Fixed in
3.3.24
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.3.24 or newer.
Official ID
CVE-2024-5973
Report title
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.3.23 - Unauthenticated Limited Privilege Escalation to Instructor
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 3.2.12)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.12
Fixed in
3.2.13
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.2.13 or newer.
Official ID
CVE-2024-37094
Report title
MasterStudy LMS <= 3.2.12 - Missing Authorization
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.1
Fixed in
3.2.2
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.2.2 or newer.
Official ID
CVE-2024-37093
Report title
MasterStudy LMS <= 3.2.1 - Cross-Site Request Forgery
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 3.3.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.3.8
Fixed in
3.3.9
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.3.9 or newer.
Official ID
CVE-2024-3942
Report title
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.3.8 - Missing Authorization
First reported
Sources
This week

A stranger could read or delete private files on your server (up to and including 3.3.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.3.3
Fixed in
3.3.4
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.3.4 or newer.
Official ID
CVE-2024-3136
Report title
MasterStudy LMS <= 3.3.3 - Unauthenticated Local File Inclusion via template
First reported
Sources
This week

A stranger could take over your site as an admin (up to and including 3.3.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.3.1
Fixed in
3.3.2
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.3.2 or newer.
Official ID
CVE-2024-2409
Report title
MasterStudy LMS <= 3.3.1 - Unauthenticated Privilege Escalation via stm_lms_register AJAX Action
First reported
Sources
This week

A stranger could read or delete private files on your server (up to and including 3.3.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.3.0
Fixed in
3.3.1
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.3.1 or newer.
Official ID
CVE-2024-2411
Report title
MasterStudy LMS <= 3.3.0 - Unauthenticated Local File Inclusion via modal
First reported
Sources
This week

Someone could see private information they should not see (up to and including 3.2.13)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.13
Fixed in
3.3.0
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.3.0 or newer.
Official ID
CVE-2024-1904
Report title
MasterStudy LMS <= 3.2.13 - Missing Authorization to Sensitive Information Exposure in search_posts
First reported
Sources
This week

Someone could use it to harm your site (up to and including 3.2.10)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.10
Fixed in
3.2.11
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.2.11 or newer.
Official ID
CVE-2024-2106
Report title
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.10 - Basic Information Exposure via REST route
First reported
Sources
This week

A stranger could read or change the data in your site’s database

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.5
Fixed in
3.2.6
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.2.6 or newer.
Official ID
CVE-2024-1512
Report title
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.5 - Unauthenticated SQL Injection
First reported
Sources
This week

Someone could take over your site as an admin

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.0.17
Fixed in
3.0.18
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.0.18 or newer.
Official ID
CVE-2023-4278
Report title
MasterStudy LMS <= 3.0.17 - Privilege Escalation
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.7.9
Fixed in
2.8.0
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 2.8.0 or newer.
Official ID
CVE-2023-33999
Report title
Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.0.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.0.8
Fixed in
3.0.9
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.0.9 or newer.
Official ID
CVE-2023-35090
Report title
MasterStudy LMS <= 3.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 3.0.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.0.8
Fixed in
3.0.9
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 3.0.9 or newer.
Official ID
CVE-2023-35093
Report title
MasterStudy LMS <= 3.0.8 - Missing Authorization to Course Category Creation
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 2.9.34)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.9.34
Fixed in
2.9.35
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 2.9.35 or newer.
Report title
MasterStudy LMS WordPress Plugin <= 2.9.34 - Missing Authorization via wp_ajax_stm_wpcfto_get_settings
First reported
Sources
This week

A stranger could use it to harm your site (up to and including 2.7.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.7.5
Fixed in
2.7.6
What to do
If your site has an affected version, update MasterStudy LMS WordPress Plugin to version 2.7.6 or newer.
Official ID
CVE-2022-0441
Report title
MasterStudy LMS < 2.7.6 - Unauthenticated Admin Account Creation
First reported
Sources

Where this comes from

We collect these reports from public security sources and rewrite them in plain words. Each problem shows its sources and the date we first saw it. This page never says whether your own site is affected: only a check of your site’s versions can tell.

All plugins and themes

Get an email when your site is affected.

Install Watchfox AI once. It checks your plugins and themes against this list every day, for free.

Install Watchfox AI (free)