high advisory November 12, 2026

Masterstudy Education WordPress Theme: Privilege Escalation (CVE-2026-13764)

The Masterstudy Education WordPress Theme is vulnerable to privilege escalation in versions 4.8.151 and below due to missing authorization and nonce validation, allowing authenticated subscribers to elevate their privileges to administrator.

Triage facts

Revision 1

Applicability: Masterstudy - Education WordPress Theme (<= 4.8.151)
Evidence: Unknown
Severity: High
Action: Immediate escalation
Sources: 1 public source
Freshness: Revision 1Nov 12, 14:15 UTC
Detection: 1 rule
Vulnerabilities: 1 CVE
Source quality: A1Likely

The Masterstudy - Education WordPress Theme for WordPress is vulnerable to privilege escalation in all versions up to and including 4.8.151. The issue stems from missing authorization and nonce validation on the masterstudy_ms_stm_set_discard_transient AJAX action. An authenticated attacker with Subscriber-level access or higher can exploit this to set the stm_developer_access_token transient. By leveraging the developer access auto-login flow, the attacker can obtain administrative session cookies.

Impact

Successful exploitation allows an authenticated attacker to elevate their privileges to Administrator, granting full control over the WordPress instance.

Recommendation

Update the Masterstudy - Education WordPress Theme to a version newer than 4.8.151 immediately. If an update is unavailable, disable the theme or restrict access to the affected AJAX endpoint.

Immediate actions

Update Masterstudy - Education WordPress Theme to a version newer than 4.8.151

IT Operations 24h

Threat Hunt

Identify requests to the masterstudy_ms_stm_set_discard_transient endpoint from low-privilege (Subscriber) users

T1068 high high confidence convert to detection

Data: web server logs linked to user IDs or session tokens

Detection coverage 1

Detect CVE-2026-13764 Exploitation Attempt

high

Detects exploitation of CVE-2026-13764 by monitoring for unauthorized requests to the vulnerable masterstudy_ms_stm_set_discard_transient AJAX action.

sigma tactics: privilege-escalation techniques: T1068 sources: webserver

Detection queries are available on the platform. Get full rules →