EUVD-2026-69850

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not restrict access to a REST route that lists an author's courses, nor does it filter that listing by publication status, allowing unauthenticated users to read the titles and IDs of unpublished draft, pending and private...

WordPress MasterStudy LMS WordPress Plugin plugin < 3.7.46 - Instructor+ Quiz Answer Disclosure vulnerability

Instructor+ Quiz Answer Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin MasterStudy LMS versions 3.7.46...

EUVD-2026-69848

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning per-student course enrollment and progress data, allowing unauthenticated attackers to disclose the enrolled courses and learning progress of any registered user...

CVE-2026-81195

The MasterStudy LMS WordPress plugin (versions before 3.7.46 ) lacks an authorization check on the student-courses REST route , allowing unauthenticated attackers to retrieve per-student course enrollment and learning progress data for any registered user. The vulnerability was discovered by Abdu...

CVE-2026-81197

The MasterStudy LMS WordPress plugin (versions before 3.7.46 ) contains an Unauthenticated Unpublished Course Title Disclosure vulnerability. The plugin's course-list REST route does not restrict access nor filter results by publication status, allowing unauthenticated users to retrieve the title...

EUVD-2026-69847

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify authorization when retrieving order line-item data, allowing any authenticated user including Subscribers to read other instructors' course sales records by supplying another user's identifier...

WordPress MasterStudy LMS WordPress Plugin plugin < 3.7.46 - Unauthenticated Student Enrollment Disclosure vulnerability

Unauthenticated Student Enrollment Disclosure vulnerability discovered by Abdullah Kareem in WordPress Plugin MasterStudy LMS versions 3.7.46...

WordPress MasterStudy LMS WordPress Plugin plugin < 3.7.46 - Unauthenticated Unpublished Course Title Disclosure vulnerability

Unauthenticated Unpublished Course Title Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin MasterStudy LMS versions 3.7.46...

PT-2026-84632

Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress Plugin versions prior to 3.7.46 Description An authorization check is missing before returning student learning statistics, which allows unauthenticated attackers to disclose course counts, points, certificates, and...

CVE-2026-81200

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.42 does not correctly restrict access to order information, allowing any user with the instructor role to read other users' order billing details, including name, email address, phone number and postal address, by enumerating order...

CVE-2026-81342

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.43 does not validate a redirect parameter supplied during user registration before using it, allowing unauthenticated attackers to redirect users to arbitrary external URLs...

CVE-2026-81026

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.40 does not verify the amount, receiver, currency or status of a payment notification before marking the corresponding order completed, allowing unauthenticated users to complete full-price orders and gain access to paid content by...

EUVD-2026-68062

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.40 does not verify the amount, receiver, currency or status of a payment notification before marking the corresponding order completed, allowing unauthenticated users to complete full-price orders and gain access to paid content by...

EUVD-2026-68064

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.43 does not validate a redirect parameter supplied during user registration before using it, allowing unauthenticated attackers to redirect users to arbitrary external URLs...

CVE-2026-81026

MasterStudy LMS WordPress plugin versions prior to 3.7.40 contain an unauthenticated payment bypass via PayPal IPN (Instant Payment Notification). The plugin fails to verify the amount, receiver, currency, or status of an incoming payment notification before marking the corresponding order as com...

CVE-2026-81342

MasterStudy LMS WordPress Plugin versions prior to 3.7.43 are affected by an unauthenticated open redirect . The plugin fails to validate a redirect parameter supplied during user registration before using it, allowing an attacker to redirect users to arbitrary external URLs. The vulnerability re...

CVE-2026-81026 MasterStudy LMS < 3.7.40 - Unauthenticated Payment Bypass via PayPal IPN

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.40 does not verify the amount, receiver, currency or status of a payment notification before marking the corresponding order completed, allowing unauthenticated users to complete full-price orders and gain access to paid content by...

CVE-2026-81200 MasterStudy LMS < 3.7.42 - Instructor+ Cross-Tenant Order Billing PII Disclosure via IDOR

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.42 does not correctly restrict access to order information, allowing any user with the instructor role to read other users' order billing details, including name, email address, phone number and postal address, by enumerating order...

CVE-2026-81200

CVE-2026-81200 affects the MasterStudy LMS WordPress plugin in versions before 3.7.42 . The flaw is an improper access restriction (IDOR) in the order information handling: any user holding the instructor role can enumerate order IDs to read other users' billing details—name, email address, phone...

EUVD-2026-68063

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.42 does not correctly restrict access to order information, allowing any user with the instructor role to read other users' order billing details, including name, email address, phone number and postal address, by enumerating order...