The MasterStudy LMS plugin contains a race condition in shared resource handling, which can be exploited by concurrently executing requests. The flaw, classified as CWE-362, allows attackers to manipulate the order of operations, potentially leading to inconsistent data states or incorrect processing within the plugin. The CVSS score of 4.3 indicates that the design impact is moderate but not trivial, emphasizing the need for careful assessment.

Stylemix’s MasterStudy LMS plugin is affected in all releases up to and including version 3.6.20. Any WordPress site that has installed this plugin within that version range is potentially vulnerable. The vulnerability is tied specifically to the plugin’s internal race‑condition handling rather than the WordPress core.

The EPSS score of < 1% reflects a low probability of exploitation in the wild as of the last measurement, and the issue is not listed in the CISA KEV catalog. The attack vector is inferred to be via concurrent HTTP requests to the plugin’s endpoints, requiring an authenticated user or a privileged role such as an instructor or administrator. Successful exploitation could alter lesson data, access permissions, or other LMS features. The moderate CVSS score and low EPSS suggest a moderate risk, but site owners should still evaluate potential business impact if the LMS is critical to operations.