# CVE-2026-57640: StylemixThemes MasterStudy LMS broken access control

Source: https://junglewise.ai/threats/cve-2026-57640-stylemixthemes-masterstudy-lms-broken-access-control  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-26. Updated: 2026-06-26  
License: CC BY 4.0 with a link back

CVE-2026-57640 · Severity: medium · CVSS 4.3 · Published 2026-06-26

MasterStudy LMS is a WordPress plugin used to create and manage online courses and learning platforms. A security flaw in versions up to 3.7.30 allows users with basic 'Subscriber' accounts to perform actions they should not be authorized to do. This could allow students or low-level users to interfere with site settings or content, potentially disrupting the learning environment.

Technologies: [StylemixThemes MasterStudy LMS](https://junglewise.ai/threats/technologies/masterstudy-lms). Vendors: [StylemixThemes](https://junglewise.ai/threats/vendors/stylemixthemes).

## Quick answers

**Is CVE-2026-57640 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57640 being exploited in the wild.

**How severe is CVE-2026-57640?** Medium severity, with a CVSS score of 4.3, published 26 June 2026.

**Which products and versions are affected?** StylemixThemes MasterStudy LMS <= 3.7.30.

**Is there a fix for CVE-2026-57640?** A patch was published on 2026-06-26: Version 3.7.31 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57640 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-57640?** Check whether you run StylemixThemes MasterStudy LMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A broken access control vulnerability exists in the MasterStudy LMS plugin for WordPress due to missing authorization checks (CWE-862). An attacker with Subscriber-level privileges can exploit this flaw via network requests to execute functions or modify data that should be restricted to higher-privileged roles. The vulnerability is present in versions up to and including 3.7.30. A fix is available in version 3.7.31, which implements the necessary access control checks.

## Affected products

- StylemixThemes MasterStudy LMS <= 3.7.30

## Timeline

- 2026-02-17: other: Reported by researcher 'lagi bljr'
- 2026-06-26: disclosed: Early warning sent to Patchstack customers
- 2026-06-26: patched: Version 3.7.31 released to address the issue
- 2026-06-26: advisory: Public advisory published by Patchstack and NVD

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/masterstudy-lms-learning-management-system/vulnerability/wordpress-masterstudy-lms-plugin-3-7-30-broken-access-control-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/masterstudy-lms-learning-management-system/vulnerability/wordpress-masterstudy-lms-plugin-3-7-30-broken-access-control-vulnerability?_s_id=cve)

## Related threats

- [StylemixThemes MasterStudy LMS content injection via XSS](https://junglewise.ai/threats/cve-2026-119478-improper-neutralization-of-script-related-html-tags-in-a-web)
- [MasterStudy LMS PHP object injection in subscriber handling](https://junglewise.ai/threats/cve-2026-118090-subscriber-php-object-injection-in-masterstudy-lms-3-7-55)
- [MasterStudy LMS path traversal in file import](https://junglewise.ai/threats/cve-2026-80067-masterstudy-lms-plugin-for-wordpress-before-3-7-50-contains-a)
- [StylemixThemes MasterStudy LMS broken access control](https://junglewise.ai/threats/cve-2026-118092-missing-authorization-vulnerability-in-stylemixthemes)
- [MasterStudy LMS unauthenticated arbitrary file deletion](https://junglewise.ai/threats/cve-2026-78284-masterstudy-lms-unauthenticated-arbitrary-file-deletion)