CVE-2026-88849 MasterStudy LMS 3.7.13 - 3.7.54 - Instructor+ Arbitrary User Display Name Update via Student Enrollment

Low 2.7 Published 22 Oct 2026 Updated 22 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-88849?

CVE-2026-88849 is a low-severity vulnerability in Unknown MasterStudy LMS WordPress Plugin, published on 22 Oct 2026.

Official description

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.55 does not verify that a user targeted through its student-enrolment feature has any relationship to the requesting instructor, allowing users with the Instructor role to overwrite the first name, last name and public display name of any registered user on the site, including administrators, enabling impersonation and phishing.

Weakness: CWE-863

Which versions are affected by CVE-2026-88849?

How do I fix CVE-2026-88849?

No fix has been published for CVE-2026-88849 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-88849 being exploited?

There is no known exploitation of CVE-2026-88849 in the wild and no public exploit code.

Sources

Also known as GHSA-x2jm-76mq-q2pc.