The MasterStudy LMS WordPress Plugin before version 3.7.50 fails to perform capability or nonce checks on a maintenance action triggered by a demo import. This flaw permits any authenticated user, including subscribers, to initiate the import, causing courses or lessons to be published under their own account. The result is unauthorized content creation, violating the integrity of the site's content ecosystem.

All installations of MasterStudy LMS WordPress Plugin older than 3.7.50 are vulnerable. Users with subscriber or other non‑administrative roles on such sites can trigger the flaw. No other vendors or products are identified in the available data.

The CVSS score of 4.3 indicates moderate severity while the EPSS score of <1% reflects a low probability of exploitation and it is not listed in the CISA KEV catalog. An attacker only needs to be authenticated; no privilege escalation is required. The vulnerability threatens the integrity of site content and could be exploited for malicious use, but the risk is confined to the internal content domain.