CVE-2025-13766: 
WordPress vulnerability analysis and mitigation

CVE-2025-13766 is a Missing Authorization vulnerability in the MasterStudy LMS WordPress Plugin – for Online Courses and Education, affecting all versions up to and including 3.7.6. The flaw allows authenticated attackers with Subscriber-level access or above to perform unauthorized data modification and deletion via multiple unprotected REST API endpoints. It was disclosed on January 6, 2026, with Wordfence as the reporting CNA. The vulnerability carries a CVSS v3.1 base score of 5.4 (Medium) (Wordfence, NVD).

The root cause is CWE-862 (Missing Authorization): multiple REST API endpoints in the MasterStudy LMS plugin fail to perform capability checks before executing privileged operations. Because no server-side permission validation is enforced on these endpoints, any authenticated WordPress user — even one with the lowest default role (Subscriber) — can invoke them directly over the network. Exploitable actions include uploading or deleting arbitrary media files, deleting or modifying posts, and creating or managing course templates. No user interaction is required beyond authentication, and attack complexity is low (Wordfence, NVD).

Successful exploitation allows low-privileged authenticated users to tamper with site content by modifying or deleting posts, uploading arbitrary media files (potentially including malicious content), and managing course templates without administrative approval. This poses a meaningful integrity risk to e-learning platforms built on MasterStudy LMS, as course content could be defaced or destroyed. Confidentiality impact is limited (low), and availability is not directly affected, but data loss from unauthorized deletion could disrupt platform operations (Wordfence).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-13766. The vulnerability requires authentication (Subscriber-level or above), which limits the attack surface compared to unauthenticated flaws. The EPSS score is approximately 0.025% (0.000250), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence, NVD).

1. Reconnaissance: Identify WordPress sites running MasterStudy LMS plugin version ≤ 3.7.6 using tools like WPScan or by inspecting plugin metadata at /wp-content/plugins/masterstudy-lms-learning-management-system/readme.txt.
2. Obtain Subscriber-level access: Register a standard user account on the target WordPress site (if open registration is enabled) or use any existing low-privilege credentials.
3. Enumerate REST API endpoints: Probe the WordPress REST API (e.g., GET /wp-json/) to identify MasterStudy LMS-specific endpoints that lack capability checks.
4. Send unauthorized requests: Craft authenticated REST API requests (using a valid WordPress nonce or cookie) to the vulnerable endpoints to perform privileged actions such as uploading media files, deleting posts, or modifying course templates.
5. Achieve objective: Depending on attacker goals — delete course content to disrupt the platform, upload malicious media files, or alter course templates to distribute misleading or harmful content to students (Wordfence).

• Logs: WordPress access logs showing authenticated REST API requests to MasterStudy LMS endpoints (e.g., /wp-json/masterstudy-lms/v1/...) from low-privilege user accounts performing media uploads, post deletions, or course template modifications.
• File System: Unexpected or suspicious media files uploaded to the WordPress wp-content/uploads/ directory, particularly files not associated with administrative activity.
• Application Logs: WordPress debug logs or audit plugin logs recording unauthorized post modifications or deletions attributed to Subscriber-level user accounts.
• Database: Unexpected changes to post content, post status, or course template records in the WordPress database (wp_posts, wp_postmeta) made by non-administrator user IDs.

The vulnerability is patched in MasterStudy LMS plugin version 3.7.7 and later, which adds proper capability checks to the affected REST API endpoints. Site administrators should update the plugin immediately via the WordPress admin dashboard or the WordPress plugin repository. As a temporary workaround, restricting user registration or disabling open Subscriber-level account creation can reduce the attack surface until patching is feasible (Wordfence, WordPress Changeset).

Wordfence disclosed the vulnerability through their threat intelligence platform and served as the CNA for this CVE. No significant broader media coverage, notable researcher commentary, or social media discussion beyond automated CVE tracking feeds has been identified for this vulnerability.