The MasterStudy LMS WordPress Plugin allows any user with the Instructor role to modify the first name, last name, and public display name of any registered user, including administrators, without verifying that the target user is actually enrolled in the class. This missing access‑control check represents a CWE‑863 External Control Over Critical Resource Access weakness, enabling an instructor to impersonate other users and carry out phishing or social engineering attacks. The vulnerability directly compromises user identity integrity and can be exploited to mislead site visitors and collaborators.

The issue exists in MasterStudy LMS WordPress Plugin versions 3.7.13 through 3.7.54 inclusive. Version 3.7.55 and later contain the fix. All installations of the plugin before 3.7.55 that permit instructors to enroll students are affected.

The vulnerability is a low‑severity privilege escalation with a CVSS score of 2.7 that may be exploited by anyone who can obtain or create an Instructor role. No known public exploit is listed in the CISA KEV catalog, and EPSS indicates an exploitation probability of about 0.13%. The lack of verification grants attackers impersonation capabilities, making the risk significant for sites where instructors manage student access.