CVE-2026-88845 is a missing authorization vulnerability (CWE-862) in the MasterStudy LMS WordPress Plugin before version 3.7.50. The plugin fails to perform capability or nonce verification on a critical administrative maintenance action. As a result, any authenticated user, regardless of privilege level, can trigger this action and create published content under their own user account on the affected WordPress site.

The vulnerability allows authenticated users with minimal privileges to escalate their capabilities by creating published content on the site. This could lead to unauthorized content injection, potential defacement, or misuse of the site’s publishing features. However, it requires the attacker to be authenticated, and there is no indication of remote unauthenticated exploitation.

Upgrade the MasterStudy LMS WordPress Plugin to version 3.7.50 or later, where this authorization issue has been fixed. Until then, restrict user roles and permissions carefully to limit authenticated users to trusted individuals only. Patch status is not explicitly confirmed in the input data, but the presence of a fixed version (3.7.50) implies an official fix is available.