Veille CVE

Jeudi 24 septembre 2026

4 CVE

Critique 0 Élevée 1 Moyenne 3 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Unknown MasterStudy LMS WordPress Plugin » ✕
  1. CVE-2026-88847 4.3 Moyenne

    Unknown MasterStudy LMS WordPress Plugin

    The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that a user is enrolled in a course before recording lesson completions against it, allowing any authenticated user, such as a subscriber, to create course progress records for courses they have no access to.

  2. CVE-2026-88846 5.3 Moyenne

    Unknown MasterStudy LMS WordPress Plugin

    The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not check whether user registration is enabled on the site before creating an account through one of its front-end registration flows, allowing unauthenticated users to create accounts, and be logged into them, on sites where registration has been deliberately disabled.

  3. CVE-2026-88845 4.3 Moyenne

    Unknown MasterStudy LMS WordPress Plugin

    The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform any capability or nonce checks on an administrative maintenance action, allowing any authenticated user, such as a subscriber, to trigger it and create published content on the site attributed to their own account.

  4. CVE-2026-88843 7.2 Élevée

    Unknown MasterStudy LMS WordPress Plugin

    The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to build a template path, allowing users with the Contributor role and above to include and execute arbitrary local PHP files on the server. An equivalent path was corrected in an earlier release and this one was not, so the issue persists in versions the earlier advisory reports as fixed.