# CVE-2026-28145: StylemixThemes MasterStudy LMS user state manipulation

Source: https://junglewise.ai/threats/cve-2026-28145-stylemixthemes-masterstudy-lms-user-state-manipulation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-31. Updated: 2026-07-31  
License: CC BY 4.0 with a link back

CVE-2026-28145 · Severity: medium · CVSS 5.3 · Published 2026-07-31

MasterStudy LMS is a popular WordPress plugin used to create and manage online courses and learning platforms. A security flaw in the plugin allows unauthorized individuals to manipulate user-related data or states without needing to log in. This could potentially allow attackers to interfere with student progress or modify user settings, though it does not directly lead to full site takeover or data theft.

Technologies: [StylemixThemes MasterStudy LMS](https://junglewise.ai/threats/technologies/masterstudy-lms). Vendors: [StylemixThemes](https://junglewise.ai/threats/vendors/stylemixthemes).

## Quick answers

**Is CVE-2026-28145 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-28145 being exploited in the wild.

**How severe is CVE-2026-28145?** Medium severity, with a CVSS score of 5.3, published 31 July 2026.

**Which products and versions are affected?** StylemixThemes MasterStudy LMS n/a through 3.7.39.

**Is there a fix for CVE-2026-28145?** A patch was published on 2026-07-31: Fixed in version 3.7.40 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-28145 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-28145?** Check whether you run StylemixThemes MasterStudy LMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The MasterStudy LMS plugin for WordPress (versions up to 3.7.39) contains a broken access control vulnerability classified as CWE-345 (Insufficient Verification of Data Authenticity). The flaw exists because the application fails to properly validate the source or integrity of data in certain functions, allowing an unauthenticated remote attacker to manipulate user states. This typically involves missing nonce checks or insufficient authorization logic. An attacker can exploit this over the network without user interaction to modify specific user-related parameters. The issue is resolved in version 3.7.40.

## Affected products

- StylemixThemes MasterStudy LMS n/a through 3.7.39

## Timeline

- 2026-07-17: other: Reported by Abdullah Kareem
- 2026-07-31: advisory: Published by Patchstack and NVD
- 2026-07-31: patched: Fixed in version 3.7.40

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/masterstudy-lms-learning-management-system/vulnerability/wordpress-masterstudy-lms-plugin-3-7-39-broken-access-control-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/masterstudy-lms-learning-management-system/vulnerability/wordpress-masterstudy-lms-plugin-3-7-39-broken-access-control-vulnerability?_s_id=cve)

## Related threats

- [StylemixThemes MasterStudy LMS content injection via XSS](https://junglewise.ai/threats/cve-2026-119478-improper-neutralization-of-script-related-html-tags-in-a-web)
- [MasterStudy LMS PHP object injection in subscriber handling](https://junglewise.ai/threats/cve-2026-118090-subscriber-php-object-injection-in-masterstudy-lms-3-7-55)
- [MasterStudy LMS path traversal in file import](https://junglewise.ai/threats/cve-2026-80067-masterstudy-lms-plugin-for-wordpress-before-3-7-50-contains-a)
- [StylemixThemes MasterStudy LMS broken access control](https://junglewise.ai/threats/cve-2026-118092-missing-authorization-vulnerability-in-stylemixthemes)
- [MasterStudy LMS unauthenticated arbitrary file deletion](https://junglewise.ai/threats/cve-2026-78284-masterstudy-lms-unauthenticated-arbitrary-file-deletion)