The MasterStudy LMS plugin for WordPress is susceptible to a privilege escalation flaw that allows users assigned the Subscriber role to obtain elevated permissions. This vulnerability is characterized by a classic authorization bypass (CWE-266), enabling lower‑level accounts to gain higher privileges without proper access controls. The impact is the potential compromise of website administration functions, leading to unauthorized content creation, data modification, or installation of additional malicious plugins.

Stylemix’s MasterStudy LMS plugin for WordPress, in all releases up to and including version 3.7.41. No later versions are affected, and the issue is specific to the vendor’s implementation of subscriber role handling.

With a CVSS score of 6.3, the flaw presents moderate severity. The exploitability is likely remote, occurring through web requests to the plugin, and requires the attacker to be a recognized Subscriber user. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation has not been documented. Nonetheless, any attacker who can authenticate as a Subscriber can elevate to administrative levels, posing a significant risk if the plugin remains unpatched.