What is GHSA-x2jm-76mq-q2pc?

GHSA-x2jm-76mq-q2pc is a security advisory published by GitHub Security Advisories with Low severity. The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.55 does not verify that a user...

Which CVE IDs does GHSA-x2jm-76mq-q2pc cover?

GHSA-x2jm-76mq-q2pc covers the following CVE IDs: CVE-2026-88849. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-x2jm-76mq-q2pc?

GHSA-x2jm-76mq-q2pc has a CVSS v3 base score of 2.7, published by GitHub Security Advisories.

GHSA-x2jm-76mq-q2pcLowCVSS 2.7

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.55 does not verify that a user...

Vendor

GitHub Security Advisories

Published

October 22, 2026

Last Modified

October 22, 2026

🔗 CVE IDs covered (1)

CVE-2026-88849 →

📋 Description

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.55 does not verify that a user targeted through its student-enrolment feature has any relationship to the requesting instructor, allowing users with the Instructor role to overwrite the first name, last name and public display name of any registered user on the site, including administrators, enabling impersonation and phishing.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-88849
https://wpscan.com/vulnerability/fa3df78f-d12f-4f10-8ed4-5e295123141b
https://github.com/advisories/GHSA-x2jm-76mq-q2pc