CVE-2026-13764
Deferred Deferred - Pending Action

Privilege Escalation in Masterstudy WordPress Theme

Publication date: 2026-11-12

Last updated on: 2026-11-12

Assigner: Wordfence

Description
The Masterstudy - Education WordPress Theme theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.151. This is due to missing authorization and nonce validation on the `masterstudy_ms_stm_set_discard_transient` AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to Administrator by setting the `stm_developer_access_token` transient and using the developer access auto-login flow to obtain administrator session cookies.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-12
Last Modified
2026-11-12
Generated
2026-11-12
AI Q&A
2026-11-12
EPSS Evaluated
N/A
NVD
CVE-2026-13764
EUVD
EUVD-2026-124350

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
StylemixThemes Masterstudy - Education WordPress Theme From 0 (inc) to 4.8.151 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Masterstudy - Education WordPress Theme has a privilege escalation vulnerability in versions up to 4.8.151. It allows authenticated attackers with Subscriber-level access or higher to escalate their privileges to Administrator by exploiting missing authorization and nonce validation on the masterstudy_ms_stm_set_discard_transient AJAX action. This enables setting a developer access token transient and using an auto-login flow to obtain administrator session cookies.

Detection Guidance

Check WordPress sites for the Masterstudy theme version 4.8.151 or lower. Look for unauthorized AJAX calls to masterstudy_ms_stm_set_discard_transient. Inspect transient settings for stm_developer_access_token.

Impact Analysis

If exploited, this vulnerability allows attackers to gain full administrative control over a WordPress site running the vulnerable Masterstudy theme. This could lead to complete site takeover, unauthorized data access, modification or deletion of content, installation of malicious plugins, or further compromise of user accounts and sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized access and modification of sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations may face compliance breaches, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Update the Masterstudy theme to the latest version above 4.8.151. Remove Subscriber-level access for untrusted users. Monitor for unauthorized privilege changes or admin session cookies.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13764. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...