The Masterstudy Education WordPress Theme contains a privilege escalation vulnerability in all versions up to and including 4.8.151. The flaw arises from missing authorization and nonce validation on a specific AJAX action, allowing authenticated users with Subscriber-level access or higher to escalate their privileges to Administrator by manipulating a transient and exploiting an auto-login flow.