CVE-2026-28145 StylemixThemes CVE debrief

Who should care

Security teams and administrators responsible for MasterStudy LMS installations should be aware of this vulnerability and take necessary actions to verify data authenticity and prevent user state manipulation. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Technical summary

CVE-2026-28145 is an Insufficient Verification of Data Authenticity vulnerability in MasterStudy LMS, which allows for user state manipulation. The vulnerability affects MasterStudy LMS versions from n/a through 3.7.39. The CVSS score for this vulnerability is 5.3, classified as MEDIUM severity. Security teams should implement additional validation for user input and monitor user state.

Defensive priority

Medium priority given the CVSS score of 5.3 and the potential for user state manipulation.

Recommended defensive actions

• Verify the authenticity of user data in MasterStudy LMS
• Implement additional validation for user input
• Monitor user state for anomalies
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets

Evidence notes

The CVE-2026-28145 record indicates an Insufficient Verification of Data Authenticity vulnerability in MasterStudy LMS, allowing for user state manipulation. The issue affects MasterStudy LMS versions from n/a through 3.7.39. Limited details are available from the CVE and NVD records. Defenders should verify user data authenticity and monitor for anomalies.

Official resources