CVE-2025-59577: 
WordPress vulnerability analysis and mitigation

CVE-2025-59577 is a Race Condition vulnerability in the Stylemix MasterStudy LMS WordPress plugin (masterstudy-lms-learning-management-system) that allows authenticated attackers with Subscriber-level privileges to exploit improper synchronization of shared resources. It affects all versions up to and including 3.6.20, with version 3.6.21 containing the fix. The vulnerability was discovered by researcher Bibek Dhakal, reported on August 28, 2025, and publicly disclosed on September 22, 2025. It carries a CVSS v3.1 base score of 4.3 (Medium) (Patchstack, Feedly).

The root cause is classified as CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization — Race Condition), mapped to CAPEC-26 (Leveraging Race Conditions) and CAPEC-29 (Leveraging Time-of-Check and Time-of-Use / TOCTOU Race Conditions). An authenticated attacker with at least Subscriber-level access can send concurrent or rapid sequential requests to exploit a time-of-check/time-of-use window in the plugin's logic, potentially manipulating shared state before it is properly validated or committed. The attack vector is network-based, requires low privileges, and no user interaction, making it straightforward to trigger for any registered user on an affected WordPress site (Patchstack, Feedly).

Successful exploitation results in a limited integrity impact — specifically, unauthorized modification of data within the LMS plugin's shared resources — with no direct confidentiality or availability impact per the CVSS assessment. In practice, this could allow a malicious subscriber or student to manipulate course enrollment states, quiz results, or other LMS data by winning a race condition window. While the individual impact is low, mass-exploit campaigns targeting WordPress plugins at scale could affect a large number of sites simultaneously (Patchstack).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-59577 as of the disclosure date. The EPSS score is approximately 0.061%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress plugins regardless of site popularity, though this specific issue is rated low priority with unlikely exploitation impact (Patchstack, Feedly).

The vendor Stylemix has released version 3.6.21 of the MasterStudy LMS plugin, which patches this vulnerability. Site administrators should update the plugin to version 3.6.21 or later immediately via the WordPress admin dashboard. If an immediate update is not possible, restricting user registration or limiting Subscriber-level access to the affected plugin's features can reduce exposure. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).