The MasterStudy LMS plugin up to version 3.7.41 contains a broken access control flaw that allows an authenticated subscriber to access content or administrative functions beyond their permitted scope. The weakness is identified as CWE‑862. This can lead to unauthorized disclosure of course material, alteration of learning paths, or other actions that compromise confidentiality and integrity of the learning platform.

The vulnerability affects the MasterStudy LMS learning management system from Stylemix available to WordPress sites. Any instance using plugin version 3.7.41 or earlier is impacted. Current releases of 3.7.42 and later incorporate the fix.

The CVSS base score of 6.5 indicates a medium severity. EPSS is not published, so the probability of exploitation cannot be quantified, and the flaw is not listed in CISA's KEV. Attackers with access to a subscriber account could exploit this flaw, potentially elevating their privileges to access protected resources. Administrators should consider the risk moderate to high for sites that rely on the LMS for privileged educational content.