Technical impact
The vulnerability arises from an insufficient verification of data authenticity within the StylemixThemes MasterStudy LMS WordPress plugin. Attackers who can submit crafted requests may manipulate the authenticated user's state or impersonate other users, thereby elevating privileges and accessing or modifying content beyond the intended scope. This weakness is classified as CWE‑345 "Broken Access Control" and focuses on unauthorized privilege escalation; it does not directly disclose sensitive data.
Affected Systems
StylemixThemes MasterStudy LMS plugin versions up to and including 3.7.39 are affected. The flaw is present in all releases from the earliest shipped version through 3.7.39. WordPress core itself is not impacted; the issue lies entirely within the plugin's integration.
Risk and Exploitability
The CVSS score of 5.3 places this issue in the moderate severity range, while an EPSS score of less than 1% indicates a low likelihood of observed exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to be able to send crafted requests to the plugin, typically via the web interface or API endpoints, enabling manipulation of user state without needing privileged credentials. Given the limited exploitation probability and absence of publicly available exploit code, the risk is moderate but warrants timely remediation.
