CVE-2025-64212: 
WordPress vulnerability analysis and mitigation

The MasterStudy LMS Pro plugin for WordPress (CVE-2025-64212) contains a missing authorization vulnerability discovered in versions up to 4.7.16 (exclusive). The vulnerability was publicly disclosed on October 12, 2025, and was identified by security researcher Rafie Muhammad from Patchstack (Rapid7, Wordfence Intel).

The vulnerability is characterized by a missing capability check on a function, which creates a security gap in the authorization process. It has been assigned a CVSS score of 4.3 (Medium) with the vector string AV:N/AC:L/Au:S/C:N/I:P/A:N, indicating network accessibility with low attack complexity and partial impact on integrity (Rapid7).

The vulnerability allows authenticated attackers with Subscriber-level access or higher to perform unauthorized actions within the WordPress installation running the affected MasterStudy LMS Pro plugin (Rapid7).

The vulnerability requires an authenticated user with at least Subscriber-level privileges to exploit. Given its medium severity rating and authentication requirement, it presents a moderate risk to affected systems (Rapid7).

Website administrators running the MasterStudy LMS Pro plugin should upgrade to version 4.7.16 or later, which contains the fix for this vulnerability (Rapid7).