PT-2026-1424 · WordPress · Wordpress+1

Thinnawarth Mathuros · Publicado 2026-01-06 · Atualizado 2026-01-06 · CVE-2025-13766

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress Plugin versions through 3.7.6

Description The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is susceptible to unauthorized modification and deletion of data. This is due to a lack of appropriate capability checks on several REST API endpoints. Authenticated attackers possessing Subscriber-level access or higher can exploit this to perform actions such as uploading or deleting arbitrary media files, modifying or deleting posts, and creating or managing course templates.

Recommendations Update to a version beyond 3.7.6.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2025-13766

Produtos afetados

Masterstudy Lms

Wordpress

Referências · 6

• https://plugins.trac.wordpress.org/changeset/3422825 · Nota
• https://t.me/cveNotify/147811 · Publicação no Telegram
• https://t.me/CVEtracker/41487 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2008462223551684828 · Publicação no Twitter
• https://wordfence.com/threat-intel/vulnerabilities/id/2719739a-90dc-470b-9270-8578e0cead59?source=cve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-13766 · Nota de Segurança