CVE-2026-81194 PUBLISHED

MasterStudy LMS < 3.7.46 - Subscriber+ Cross-Instructor Order Data Disclosure via author_id Parameter

Assigner: WPScan
Reserved: 26.08.2026 Published: 02.09.2026 Updated: 02.09.2026

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify authorization when retrieving order line-item data, allowing any authenticated user including Subscribers to read other instructors' course sales records by supplying another user's identifier.

Product Status

Vendor Unknown
Product MasterStudy LMS WordPress Plugin
Versions Default: unaffected
  • affected from 0 to 3.7.46 (excl.)

Credits

  • Abdullah Kareem finder
  • WPScan coordinator

References

Problem Types

  • CWE-639 Authorization Bypass Through User-Controlled Key CWE