460 matches found
CVE-2026-81194: Authorization Bypass Through User-Controlled Key
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify authorization when retrieving order line-item data, allowing any authenticated user including Subscribers to read other instructors' course sales records by supplying another user's identifier...
CVE-2026-81199: Exposure of Sensitive Information to an Unauthorized Actor
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning a student's learning statistics, allowing unauthenticated attackers to disclose the course counts, points, certificates, quiz and assignment totals of any registered user...
PT-2026-84629
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of quiz question identifiers, allowing users with instructor access to read other instructors' quiz questions, including the correct answers and explanations...
CVE-2026-81195: Exposure of Sensitive Information to an Unauthorized Actor
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning per-student course enrollment and progress data, allowing unauthenticated attackers to disclose the enrolled courses and learning progress of any registered user...
PT-2026-84630
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not restrict access to a REST route that lists an author's courses, nor does it filter that listing by publication status, allowing unauthenticated users to read the titles and IDs of unpublished draft, pending and private...
CVE-2026-81200
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.42 does not correctly restrict access to order information, allowing any user with the instructor role to read other users' order billing details, including name, email address, phone number and postal address, by enumerating order...
CVE-2026-81342
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.43 does not validate a redirect parameter supplied during user registration before using it, allowing unauthenticated attackers to redirect users to arbitrary external URLs...
CVE-2026-81026
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.40 does not verify the amount, receiver, currency or status of a payment notification before marking the corresponding order completed, allowing unauthenticated users to complete full-price orders and gain access to paid content by...
EUVD-2026-68062
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.40 does not verify the amount, receiver, currency or status of a payment notification before marking the corresponding order completed, allowing unauthenticated users to complete full-price orders and gain access to paid content by...
WordPress MasterStudy LMS WordPress Plugin plugin < 3.7.43 - Unauthenticated Open Redirect vulnerability
Unauthenticated Open Redirect vulnerability discovered by Abiodun Victor in WordPress Plugin MasterStudy LMS versions 3.7.43...
CVE-2026-81200 MasterStudy LMS < 3.7.42 - Instructor+ Cross-Tenant Order Billing PII Disclosure via IDOR
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.42 does not correctly restrict access to order information, allowing any user with the instructor role to read other users' order billing details, including name, email address, phone number and postal address, by enumerating order...
CVE-2026-81342 MasterStudy LMS < 3.7.43 - Unauthenticated Open Redirect
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.43 does not validate a redirect parameter supplied during user registration before using it, allowing unauthenticated attackers to redirect users to arbitrary external URLs...
EUVD-2026-68064
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.43 does not validate a redirect parameter supplied during user registration before using it, allowing unauthenticated attackers to redirect users to arbitrary external URLs...
CVE-2026-81342
The MasterStudy LMS WordPress Plugin (versions before 3.7.43 ) is vulnerable to an unauthenticated open redirect because it fails to validate a redirect parameter provided during the user registration process. This flaw allows an attacker to redirect users to arbitrary external URLs. No specific ...
CVE-2026-81026 MasterStudy LMS < 3.7.40 - Unauthenticated Payment Bypass via PayPal IPN
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.40 does not verify the amount, receiver, currency or status of a payment notification before marking the corresponding order completed, allowing unauthenticated users to complete full-price orders and gain access to paid content by...
CVE-2026-81026
The MasterStudy LMS WordPress Plugin (versions before 3.7.40 ) is vulnerable to an Unauthenticated Payment Bypass via PayPal IPN. The plugin fails to verify the amount, receiver, currency, or status of a payment notification before marking an order as completed. This allows unauthenticated users ...
EUVD-2026-68063
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.42 does not correctly restrict access to order information, allowing any user with the instructor role to read other users' order billing details, including name, email address, phone number and postal address, by enumerating order...
WordPress MasterStudy LMS WordPress Plugin plugin < 3.7.42 - Instructor+ Cross-Tenant Order Billing PII Disclosure vulnerability
Instructor+ Cross-Tenant Order Billing PII Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin MasterStudy LMS versions 3.7.42...
CVE-2026-81200
The MasterStudy LMS WordPress plugin (versions before 3.7.42 ) contains an IDOR (Insecure Direct Object Reference) vulnerability. Due to insufficient access control, any user assigned the instructor role can access and read other users' order billing details—including names, email addresses, phon...
WordPress MasterStudy LMS WordPress Plugin plugin < 3.7.40 - Unauthenticated Payment Bypass vulnerability
Unauthenticated Payment Bypass vulnerability discovered by Abdullah Kareem in WordPress Plugin MasterStudy LMS versions 3.7.40...