WordPress plugin
MasterStudy LMS WordPress Plugin – for Online Courses and Education security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical6
- High6
- Medium48
- Low0
All MasterStudy LMS WordPress Plugin – for Online Courses and Education vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.5 | Authenticated (Subscriber+) PHP Object Injection ≤3.7.55Update to 3.7.56 | CVE-2026-118090 | |
| High7.5 | 3.7.49 - Authenticated (Contributor+) Local File Inclusion 3.5.29 – 3.7.49Update to 3.7.50 | CVE-2026-88843 | |
| High7.2 | Unauthenticated Open Redirect <3.7.43Update to 3.7.43 | CVE-2026-81342 | |
| Critical9.1 | Unauthenticated Arbitrary File Deletion ≤3.7.42Update to 3.7.43 | CVE-2026-78284 | |
| High8.8 | Authenticated (Contributor+) Local File Inclusion ≤3.5.28Update to 3.5.29 | CVE-2025-32141 | |
| High7.3 | Unauthenticated Limited Privilege Escalation to Instructor ≤3.3.23Update to 3.3.24 | CVE-2024-5973 | |
| Critical9.8 | Unauthenticated Local File Inclusion via template ≤3.3.3Update to 3.3.4 | CVE-2024-3136 | |
| Critical9.8 | Unauthenticated Privilege Escalation via stm_lms_register AJAX Action ≤3.3.1Update to 3.3.2 | CVE-2024-2409 | |
| Critical9.8 | Unauthenticated Local File Inclusion via modal ≤3.3.0Update to 3.3.1 | CVE-2024-2411 | |
| Critical9.8 | Unauthenticated SQL Injection ≤3.2.5Update to 3.2.6 | CVE-2024-1512 | |
| High7.3 | Privilege Escalation ≤3.0.17Update to 3.0.18 | CVE-2023-4278 | |
| Critical9.8 | Unauthenticated Admin Account Creation ≤2.7.5Update to 2.7.6 | CVE-2022-0441 |
- High7.5Authenticated (Subscriber+) PHP Object Injection
≤3.7.55Update to 3.7.56
- High7.53.7.49 - Authenticated (Contributor+) Local File Inclusion
3.5.29 – 3.7.49Update to 3.7.50
- High7.2Unauthenticated Open Redirect
<3.7.43Update to 3.7.43
- Critical9.1Unauthenticated Arbitrary File Deletion
≤3.7.42Update to 3.7.43
- High8.8Authenticated (Contributor+) Local File Inclusion
≤3.5.28Update to 3.5.29
- High7.3Unauthenticated Limited Privilege Escalation to Instructor
≤3.3.23Update to 3.3.24
- Critical9.8Unauthenticated Local File Inclusion via template
≤3.3.3Update to 3.3.4
- Critical9.8Unauthenticated Privilege Escalation via stm_lms_register AJAX Action
≤3.3.1Update to 3.3.2
- Critical9.8Unauthenticated Local File Inclusion via modal
≤3.3.0Update to 3.3.1
- Critical9.8Unauthenticated SQL Injection
≤3.2.5Update to 3.2.6
- High7.3Privilege Escalation
≤3.0.17Update to 3.0.18
- Critical9.8Unauthenticated Admin Account Creation
≤2.7.5Update to 2.7.6
MasterStudy LMS WordPress Plugin – for Online Courses and Education: common questions
Does MasterStudy LMS WordPress Plugin – for Online Courses and Education have known vulnerabilities?
Yes. VulnCrest Radar lists 60 known vulnerabilities in MasterStudy LMS WordPress Plugin – for Online Courses and Education: 6 critical, 6 high, 48 medium. At least one is not fixed in the latest version.
How do I check which version of MasterStudy LMS WordPress Plugin – for Online Courses and Education I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent MasterStudy LMS WordPress Plugin – for Online Courses and Education vulnerability?
CVE-2026-119478, published Nov 7, 2026: MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.56 - Authenticated (Subscriber+) Arbitrary Shortcode Exeuction. Severity: Medium (CVSS 5.4).
Is any MasterStudy LMS WordPress Plugin – for Online Courses and Education vulnerability listed in CISA KEV?
No. None of the known MasterStudy LMS WordPress Plugin – for Online Courses and Education vulnerabilities is currently listed in the CISA KEV catalog.