CVE-2025-13766
Unauthorized Data Modification in MasterStudy LMS via REST API
Publication date: 2026-01-06
Last updated on: 2026-01-06
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| stylemix | masterstudy_lms | to 3.7.6 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized modification and deletion of data within the WordPress site using the MasterStudy LMS plugin. Attackers with low-level access can manipulate media files, posts, and course templates, potentially disrupting the website's content, causing data loss, or defacing the site.
What immediate steps should I take to mitigate this vulnerability?
Update the MasterStudy LMS WordPress Plugin to version 3.7.7 or later, as this version includes fixes for the unauthorized modification and deletion of data vulnerability caused by missing capability checks on REST API endpoints. [2]
Can you explain this vulnerability to me?
This vulnerability in the MasterStudy LMS WordPress Plugin allows authenticated users with Subscriber-level access or higher to bypass capability checks on multiple REST API endpoints. As a result, they can upload or delete arbitrary media files, delete or modify posts, and create or manage course templates without proper authorization.