PT-2026-1424 · WordPress · Wordpress+1

Thinnawarth Mathuros · Published 2026-01-06 · Updated 2026-01-06 · CVE-2025-13766

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress Plugin versions through 3.7.6

Description The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is susceptible to unauthorized modification and deletion of data. This is due to a lack of appropriate capability checks on several REST API endpoints. Authenticated attackers possessing Subscriber-level access or higher can exploit this to perform actions such as uploading or deleting arbitrary media files, modifying or deleting posts, and creating or managing course templates.

Recommendations Update to a version beyond 3.7.6.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-13766

Affected Products

Masterstudy Lms

Wordpress

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-13766 · Security Note
• https://plugins.trac.wordpress.org/changeset/3422825 · Note
• https://t.me/cveNotify/147811 · Telegram Post
• https://t.me/CVEtracker/41487 · Telegram Post
• https://twitter.com/CVEnew/status/2008462223551684828 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/2719739a-90dc-470b-9270-8578e0cead59?source=cve · Note