The vulnerability is a broken access control issue in the WordPress MasterStudy LMS plugin. Subscribers, normally limited to content consumption, can exploit the flaw to access administrative functions or configuration settings that they should not be able to reach. This allows an attacker to modify course data, alter user permissions, or potentially inject malicious code. The weakness is classified as CWE-862 and therefore can undermine both the integrity and confidentiality of the LMS contents.

WordPress installations that host the MasterStudy LMS plugin version 3.7.30 or earlier. The affected product belongs to the Stylemix:MasterStudy LMS library. Sites with these versions are vulnerable; newer releases (3.7.31 onward) contain the fix.

The CVSS score of 4.3 indicates a moderate impact, but the lack of an EPSS score means the exploitation probability is not quantified. The vulnerability is not listed in the CISA KEV catalog. Attackers can potentially exploit the broken access control by authenticating as a subscribed user and requesting administrative endpoints that lack proper role checks. Because the flaw originates from an unchecked role verification, it can be leveraged without additional privileges or system compromises.