CVE-2026-13764
Masterstudy - Education WordPress Theme <= 4.8.151 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
0th
The Masterstudy - Education WordPress Theme theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.151. This is due to missing authorization and nonce validation on the `masterstudy_ms_stm_set_discard_transient` AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to Administrator by setting the `stm_developer_access_token` transient and using the developer access auto-login flow to obtain administrator session cookies.
| CWE | CWE-862 |
| Vendor | stylemixthemes |
| Product | masterstudy - education wordpress theme |
| Published | Nov 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for stylemixthemes masterstudy - education wordpress theme
Be the first to know when new high vulnerabilities affecting stylemixthemes masterstudy - education wordpress theme are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
StylemixThemes / Masterstudy - Education WordPress Theme
0 ≤ 4.8.151
References
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/ec898f73-d275-4624-911b-89d9a945ff92?source=cve themeforest.net: https://themeforest.net/item/masterstudy-education-center-wordpress-theme/12170274 docs.stylemixthemes.com: https://docs.stylemixthemes.com/masterstudy-theme-documentation/extra-materials/changelog
Credits
lhking