Is CVE-2026-57640 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57640 being exploited in the wild.

How severe is CVE-2026-57640?

Medium severity, with a CVSS score of 4.3, published 26 June 2026.

Which products and versions are affected?

StylemixThemes MasterStudy LMS <= 3.7.30.

Is there a fix for CVE-2026-57640?

A patch was published on 2026-06-26: Version 3.7.31 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57640 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-57640?

Check whether you run StylemixThemes MasterStudy LMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57640: StylemixThemes MasterStudy LMS broken access control

Q: Is there a fix for CVE-2026-57640?

A patch was published on 2026-06-26: Version 3.7.31 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-57640 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-57640?

Check whether you run StylemixThemes MasterStudy LMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57640 · Severity: medium · CVSS 4.3 · Published 2026-06-26

MasterStudy LMS is a WordPress plugin used to create and manage online courses and learning platforms. A security flaw in versions up to 3.7.30 allows users with basic 'Subscriber' accounts to perform actions they should not be authorized to do. This could allow students or low-level users to interfere with site settings or content, potentially disrupting the learning environment.

Technologies: StylemixThemes MasterStudy LMS. Vendors: StylemixThemes.

Quick answers

Is CVE-2026-57640 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57640 being exploited in the wild.
How severe is CVE-2026-57640?: Medium severity, with a CVSS score of 4.3, published 26 June 2026.
Which products and versions are affected?: StylemixThemes MasterStudy LMS <= 3.7.30.
Is there a fix for CVE-2026-57640?: A patch was published on 2026-06-26: Version 3.7.31 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57640 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-57640?: Check whether you run StylemixThemes MasterStudy LMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A broken access control vulnerability exists in the MasterStudy LMS plugin for WordPress due to missing authorization checks (CWE-862). An attacker with Subscriber-level privileges can exploit this flaw via network requests to execute functions or modify data that should be restricted to higher-privileged roles. The vulnerability is present in versions up to and including 3.7.30. A fix is available in version 3.7.31, which implements the necessary access control checks.

Affected products

StylemixThemes MasterStudy LMS <= 3.7.30

Timeline

2026-02-17: other: Reported by researcher 'lagi bljr'
2026-06-26: disclosed: Early warning sent to Patchstack customers
2026-06-26: patched: Version 3.7.31 released to address the issue
2026-06-26: advisory: Public advisory published by Patchstack and NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.