Privilege Escalation Vulnerability in Masterstudy Education WordPress Theme by StylemixThemes

CVE-2026-13764

What is CVE-2026-13764?

The Masterstudy Education WordPress Theme is susceptible to a privilege escalation flaw due to inadequate authorization and nonce validation in the masterstudy_ms_stm_set_discard_transient AJAX action. This vulnerability allows authenticated users with Subscriber-level access and above to exploit the system by setting the stm_developer_access_token transient. Consequently, attackers can leverage the developer access auto-login mechanism to gain Administrator session cookies, enabling unauthorized access to sensitive site functionalities and data.

References