The MasterStudy LMS WordPress plugin contains missing authorization checks on several REST API endpoints. This deficiency allows authenticated users with Subscriber-level access or higher to upload or delete arbitrary media files, modify or delete posts, and create or manage course templates. The vulnerability is an instance of CWE‑862, meaning that the system fails to verify that the caller has permission to perform the requested action, which compromises data integrity.

The vulnerability affects the stylemix MasterStudy LMS WordPress plugin – for Online Courses and Education, specifically all releases up to and including version 3.7.6. Users running any of these versions are at risk of unauthorized modifications unless they upgrade to a fixed build.

The CVSS score of 5.4 indicates a moderate severity, while the EPSS score of less than 1% suggests a low exploitation probability under current conditions. The vulnerability is not listed in the CISA KEV catalog. Attackers need to be authenticated, and the most likely attack vector is through the plugin’s REST API endpoints that are accessible to Subscriber or more privileged users. Exploitation would allow the attacker to upload or delete arbitrary media, remove or alter posts, and manage course templates, thereby undermining the integrity and availability of site content.