Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-88843

MasterStudy LMS 3.5.29 - < 3.7.50 - Contributor+ LFI via Elementor Courses Categories Widget

cve-program · severity unknownCVSS unknownCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-88843

Published

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to build a template path, allowing users with the Contributor role and above to include and execute arbitrary local PHP files on the server. An equivalent path was corrected in an earlier release and this one was not, so the issue persists in versions the earlier advisory reports as fixed.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-88843

Published

MasterStudy LMS WordPress Plugin

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Unknown",
                    "product": "MasterStudy LMS WordPress Plugin",
                    "versions": [
                        {
                            "status": "affected",
                            "versionType": "semver",
                            "version": "3.5.29",
                            "lessThan": "3.7.50"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON