CVE-2026-81340
UnknownSummary
The MasterStudy LMS WordPress Plugin before version 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free course enrolment, revoking other users' paid enrolments, and tampering with order notes.
Risk Assessment
The risk includes order data integrity breach, unauthorized course enrollments, and potential revenue loss from paid courses.
Recommendation
Update the plugin to version 3.7.50 or later and review Instructor role permissions.
Other vulnerabilities in MasterStudy LMS WordPress Plugin
See all- CVE-2026-81195Medium
The MasterStudy LMS WordPress plugin before version 3.7.46 does not perform an authorization check before returning per-student course enrollment and progress data. This allows unauthenticated attackers to disclose the enrolled courses and learning progress of any registered user.
- CVE-2026-81194Medium
The MasterStudy LMS WordPress plugin before version 3.7.46 does not properly verify authorization when retrieving order line-item data. This allows any authenticated user, including Subscribers, to read other instructors' course sales records by supplying another user's identifier.
Original NVD description (English source)
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free course enrolment, revoking other users' paid enrolments, and tampering with order notes.