CVE-2026-81194 MasterStudy LMS < 3.7.46 - Subscriber+ Cross-Instructor Order Data Disclosure via author_id Parameter

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify authorization when retrieving order line-item data, allowing any authenticated user including Subscribers to read other instructors' course sales records by supplying another user's identifier...

WordPress MasterStudy LMS WordPress Plugin plugin < 3.7.46 - Subscriber+ Cross-Instructor Order Data Disclosure vulnerability

Subscriber+ Cross-Instructor Order Data Disclosure vulnerability discovered by Abdullah Kareem in WordPress Plugin MasterStudy LMS versions 3.7.46...

WordPress Tutor LMS plugin < 4.0.6 - Instructor+ Cross-Instructor Private Course Disclosure vulnerability

Instructor+ Cross-Instructor Private Course Disclosure vulnerability discovered by Mustafa Ahmed in WordPress Plugin Tutor LMS versions 4.0.6...