CVE-2026-81026 MasterStudy LMS < 3.7.40 - Unauthenticated Payment Bypass via PayPal IPN

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.40 does not verify the amount, receiver, currency or status of a payment notification before marking the corresponding order completed, allowing unauthenticated users to complete full-price orders and gain access to paid content by...

WordPress MasterStudy LMS WordPress Plugin plugin < 3.7.43 - Unauthenticated Open Redirect vulnerability

Unauthenticated Open Redirect vulnerability discovered by Abiodun Victor in WordPress Plugin MasterStudy LMS versions 3.7.43...

WordPress MasterStudy LMS WordPress Plugin plugin < 3.7.42 - Instructor+ Cross-Tenant Order Billing PII Disclosure vulnerability

Instructor+ Cross-Tenant Order Billing PII Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin MasterStudy LMS versions 3.7.42...

WordPress MasterStudy LMS WordPress Plugin plugin < 3.7.40 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by Abdullah Kareem in WordPress Plugin MasterStudy LMS versions 3.7.40...

CVE-2026-81026

The MasterStudy LMS WordPress Plugin (versions before 3.7.40 ) is vulnerable to an Unauthenticated Payment Bypass via PayPal IPN. The plugin fails to verify the amount, receiver, currency, or status of a payment notification before marking an order as completed. This allows unauthenticated users ...

CVE-2026-81342 MasterStudy LMS < 3.7.43 - Unauthenticated Open Redirect

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.43 does not validate a redirect parameter supplied during user registration before using it, allowing unauthenticated attackers to redirect users to arbitrary external URLs...

CVE-2026-81026 MasterStudy LMS < 3.7.40 - Unauthenticated Payment Bypass via PayPal IPN

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.40 does not verify the amount, receiver, currency or status of a payment notification before marking the corresponding order completed, allowing unauthenticated users to complete full-price orders and gain access to paid content by...

EUVD-2026-68063

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.42 does not correctly restrict access to order information, allowing any user with the instructor role to read other users' order billing details, including name, email address, phone number and postal address, by enumerating order...

CVE-2026-81200 MasterStudy LMS < 3.7.42 - Instructor+ Cross-Tenant Order Billing PII Disclosure via IDOR

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.42 does not correctly restrict access to order information, allowing any user with the instructor role to read other users' order billing details, including name, email address, phone number and postal address, by enumerating order...

CVE-2026-81342

The MasterStudy LMS WordPress Plugin (versions before 3.7.43 ) is vulnerable to an unauthenticated open redirect because it fails to validate a redirect parameter provided during the user registration process. This flaw allows an attacker to redirect users to arbitrary external URLs. No specific ...

CVE-2026-81200: Authorization Bypass Through User-Controlled Key

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.42 does not correctly restrict access to order information, allowing any user with the instructor role to read other users' order billing details, including name, email address, phone number and postal address, by enumerating order...

PT-2026-83416

Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress Plugin versions prior to 3.7.43 Description An open redirect issue exists during the user registration process. The plugin fails to validate a redirect parameter before utilizing it, which allows unauthenticated...

PT-2026-83415

Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress Plugin versions prior to 3.7.42 Description An Insecure Direct Object Reference IDOR exists where the plugin fails to correctly restrict access to order information. This allows users with the instructor role to acces...

PT-2026-83414

Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress Plugin versions prior to 3.7.40 Description An issue exists where the plugin fails to verify the amount, receiver, currency, or status of a payment notification before marking an order as completed. This allows...

CVE-2026-81342: URL Redirection to Untrusted Site

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.43 does not validate a redirect parameter supplied during user registration before using it, allowing unauthenticated attackers to redirect users to arbitrary external URLs...

CVE-2026-81026: Improper Access Control

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.40 does not verify the amount, receiver, currency or status of a payment notification before marking the corresponding order completed, allowing unauthenticated users to complete full-price orders and gain access to paid content by...

EUVD-2026-65159

Unauthenticated Arbitrary File Deletion in MasterStudy LMS = 3.7.42 versions...

CVE-2026-78284

Unauthenticated Arbitrary File Deletion in MasterStudy LMS = 3.7.42 versions...

CVE-2026-78284 WordPress MasterStudy LMS plugin <= 3.7.42 - Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion in MasterStudy LMS = 3.7.42 versions...

CVE-2026-78284

CVE-2026-78284 is an unauthenticated arbitrary file deletion vulnerability in the MasterStudy LMS WordPress plugin, affecting versions 3.7.42 and earlier . An attacker can delete files on the server without any authentication or user interaction. The CVSS 3.1 base score is 8.6 (HIGH) , driven by ...