CVE-2026-88848 MasterStudy LMS 1.9 - < 3.7.50 - Subscriber+ Membership Plan Quota and Category Restriction Bypass
Attackers can bypass membership plan restrictions to enroll in unauthorized paid courses, affecting LMS administrators and paid users.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-88848?
CVE-2026-88848 is a medium-severity vulnerability in Unknown MasterStudy LMS, published on 25 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The MasterStudy LMS WordPress plugin from 1.9 before 3.7.50 does not verify that a course a member asks to enrol in is covered by their membership plan, nor that the plan identifier submitted with the request is one they actually hold, allowing any member to enrol themselves into restricted paid courses outside their plan and beyond the number of courses it entitles them to.
Weakness: CWE-863
Which versions are affected by CVE-2026-88848?
How do I fix CVE-2026-88848?
No fix has been published for CVE-2026-88848 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-88848 being exploited?
There is no known exploitation of CVE-2026-88848 in the wild and no public exploit code.
Sources
Also known as GHSA-94g4-5p99-4jgx.