CVE-2025-13766
Unknown Unknown - Not Provided
Unauthorized Data Modification in MasterStudy LMS via REST API

Publication date: 2026-01-06

Last updated on: 2026-01-06

Assigner: Wordfence

Description
The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to unauthorized modification and deletion of data due to a missing capability checks on multiple REST API endpoints in all versions up to, and including, 3.7.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload or delete arbitrary media files, delete or modify posts, and create/manage course templates
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-06
Last Modified
2026-01-06
Generated
2026-06-16
AI Q&A
2026-01-06
EPSS Evaluated
2026-06-15
NVD
CVE-2025-13766
EUVD
EUVD-2026-1068
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
stylemix masterstudy_lms to 3.7.6 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Impact Analysis

The vulnerability can lead to unauthorized modification and deletion of data within the WordPress site using the MasterStudy LMS plugin. Attackers with low-level access can manipulate media files, posts, and course templates, potentially disrupting the website's content, causing data loss, or defacing the site.

Mitigation Strategies

Update the MasterStudy LMS WordPress Plugin to version 3.7.7 or later, as this version includes fixes for the unauthorized modification and deletion of data vulnerability caused by missing capability checks on REST API endpoints. [2]

Executive Summary

This vulnerability in the MasterStudy LMS WordPress Plugin allows authenticated users with Subscriber-level access or higher to bypass capability checks on multiple REST API endpoints. As a result, they can upload or delete arbitrary media files, delete or modify posts, and create or manage course templates without proper authorization.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-13766. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart