{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-13764/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:masterstudy:education_wordpress_theme:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-13764"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Masterstudy - Education WordPress Theme (\u003c= 4.8.151)"],"_cs_severities":["high"],"_cs_tags":["cve-2026-13764","privilege-escalation","wordpress"],"_cs_type":"advisory","_cs_vendors":["MasterStudy"],"content_html":"\u003cp\u003eThe Masterstudy - Education WordPress Theme for WordPress is vulnerable to privilege escalation in all versions up to and including 4.8.151. The issue stems from missing authorization and nonce validation on the masterstudy_ms_stm_set_discard_transient AJAX action. An authenticated attacker with Subscriber-level access or higher can exploit this to set the stm_developer_access_token transient. By leveraging the developer access auto-login flow, the attacker can obtain administrative session cookies.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated attacker to elevate their privileges to Administrator, granting full control over the WordPress instance.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpdate the Masterstudy - Education WordPress Theme to a version newer than 4.8.151 immediately. If an update is unavailable, disable the theme or restrict access to the affected AJAX endpoint.\u003c/p\u003e\n","date_modified":"2026-11-12T14:15:14Z","date_published":"2026-11-12T14:15:14Z","id":"https://feed.craftedsignal.io/briefs/2026-11-masterstudy-privilege-escalation-cve-2026-13764/","summary":"The Masterstudy Education WordPress Theme is vulnerable to privilege escalation in versions 4.8.151 and below due to missing authorization and nonce validation, allowing authenticated subscribers to elevate their privileges to administrator.","title":"Masterstudy Education WordPress Theme: Privilege Escalation (CVE-2026-13764)","url":"https://feed.craftedsignal.io/briefs/2026-11-masterstudy-privilege-escalation-cve-2026-13764/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-13764","version":"https://jsonfeed.org/version/1.1"}