4972 matches found
CVE-2026-81199 MasterStudy LMS < 3.7.46 - Unauthenticated Student Statistics Disclosure via student/stats REST Route
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning a student's learning statistics, allowing unauthenticated attackers to disclose the course counts, points, certificates, quiz and assignment totals of any registered user...
CVE-2026-81194 MasterStudy LMS < 3.7.46 - Subscriber+ Cross-Instructor Order Data Disclosure via author_id Parameter
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify authorization when retrieving order line-item data, allowing any authenticated user including Subscribers to read other instructors' course sales records by supplying another user's identifier...
CVE-2026-81194
The MasterStudy LMS WordPress plugin (versions prior to 3.7.46 ) contains an authorization bypass vulnerability. The software fails to properly verify permissions when retrieving order line-item data. This allows any authenticated user, including those with Subscriber privileges, to access and re...
WordPress MasterStudy LMS WordPress Plugin plugin < 3.7.46 - Subscriber+ Cross-Instructor Order Data Disclosure vulnerability
Subscriber+ Cross-Instructor Order Data Disclosure vulnerability discovered by Abdullah Kareem in WordPress Plugin MasterStudy LMS versions 3.7.46...
CVE-2026-81194 MasterStudy LMS < 3.7.46 - Subscriber+ Cross-Instructor Order Data Disclosure via author_id Parameter
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify authorization when retrieving order line-item data, allowing any authenticated user including Subscribers to read other instructors' course sales records by supplying another user's identifier...
EUVD-2026-69849
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of quiz question identifiers, allowing users with instructor access to read other instructors' quiz questions, including the correct answers and explanations...
CVE-2026-81197 MasterStudy LMS < 3.7.46 - Unauthenticated Unpublished Course Title Disclosure via course-list REST Route
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not restrict access to a REST route that lists an author's courses, nor does it filter that listing by publication status, allowing unauthenticated users to read the titles and IDs of unpublished draft, pending and private...
CVE-2026-81196
The MasterStudy LMS WordPress Plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) flaw in versions prior to 3.7.46 . The plugin fails to properly verify ownership of quiz question identifiers, enabling users with instructor access to view quiz questions belonging to o...
CVE-2026-81196 MasterStudy LMS < 3.7.46 - Instructor+ Quiz Answer Disclosure via IDOR
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of quiz question identifiers, allowing users with instructor access to read other instructors' quiz questions, including the correct answers and explanations...
CVE-2026-81197 MasterStudy LMS < 3.7.46 - Unauthenticated Unpublished Course Title Disclosure via course-list REST Route
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not restrict access to a REST route that lists an author's courses, nor does it filter that listing by publication status, allowing unauthenticated users to read the titles and IDs of unpublished draft, pending and private...
CVE-2026-81195 MasterStudy LMS < 3.7.46 - Unauthenticated Student Enrollment Disclosure via student-courses REST Route
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning per-student course enrollment and progress data, allowing unauthenticated attackers to disclose the enrolled courses and learning progress of any registered user...
EUVD-2026-69850
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not restrict access to a REST route that lists an author's courses, nor does it filter that listing by publication status, allowing unauthenticated users to read the titles and IDs of unpublished draft, pending and private...
WordPress MasterStudy LMS WordPress Plugin plugin < 3.7.46 - Instructor+ Quiz Answer Disclosure vulnerability
Instructor+ Quiz Answer Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin MasterStudy LMS versions 3.7.46...
CVE-2026-81195
The MasterStudy LMS WordPress Plugin (versions before 3.7.46 ) is vulnerable to an unauthorized information disclosure. The plugin fails to perform an authorization check before returning per-student course enrollment and progress data via the student-courses REST Route . This flaw allows unauthe...
EUVD-2026-69848
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning per-student course enrollment and progress data, allowing unauthenticated attackers to disclose the enrolled courses and learning progress of any registered user...
WordPress MasterStudy LMS WordPress Plugin plugin < 3.7.46 - Unauthenticated Unpublished Course Title Disclosure vulnerability
Unauthenticated Unpublished Course Title Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin MasterStudy LMS versions 3.7.46...
EUVD-2026-69847
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify authorization when retrieving order line-item data, allowing any authenticated user including Subscribers to read other instructors' course sales records by supplying another user's identifier...
CVE-2026-81195 MasterStudy LMS < 3.7.46 - Unauthenticated Student Enrollment Disclosure via student-courses REST Route
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning per-student course enrollment and progress data, allowing unauthenticated attackers to disclose the enrolled courses and learning progress of any registered user...
CVE-2026-81197
The MasterStudy LMS WordPress plugin, in versions prior to 3.7.46 , is vulnerable to an information disclosure flaw. The plugin fails to restrict access to a specific REST route that lists an author's courses and lacks filtering based on publication status. Consequently, unauthenticated users can...
WordPress MasterStudy LMS WordPress Plugin plugin < 3.7.46 - Unauthenticated Student Enrollment Disclosure vulnerability
Unauthenticated Student Enrollment Disclosure vulnerability discovered by Abdullah Kareem in WordPress Plugin MasterStudy LMS versions 3.7.46...