WordPress MasterStudy LMS WordPress Plugin plugin < 3.7.46 - Instructor+ Cross-Course Curriculum Deletion and Tampering vulnerability

Instructor+ Cross-Course Curriculum Deletion and Tampering vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin MasterStudy LMS versions 3.7.46...

CVE-2026-81198 MasterStudy LMS < 3.7.46 - Instructor+ Cross-Course Curriculum Deletion and Tampering via IDOR

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of a curriculum object before acting on it, allowing authenticated users with the instructor role to delete or modify curriculum sections and materials belonging to courses owned by other...

CVE-2026-81198

MasterStudy LMS WordPress plugin (versions before 3.7.46 ) contains an IDOR (Insecure Direct Object Reference) flaw: the plugin does not properly verify ownership of a curriculum object before acting on it. This allows authenticated users with the instructor role to delete or modify curriculum se...

CVE-2026-81199

MasterStudy LMS WordPress Plugin versions before 3.7.46 contain an unauthenticated information disclosure vulnerability in the student/stats REST route . The endpoint fails to perform an authorization check before returning a student's learning statistics, allowing any unauthenticated attacker to...

WordPress MasterStudy LMS WordPress Plugin plugin < 3.7.46 - Unauthenticated Student Statistics Disclosure vulnerability

Unauthenticated Student Statistics Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin MasterStudy LMS versions 3.7.46...

EUVD-2026-69851

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of a curriculum object before acting on it, allowing authenticated users with the instructor role to delete or modify curriculum sections and materials belonging to courses owned by other...

CVE-2026-81199 MasterStudy LMS < 3.7.46 - Unauthenticated Student Statistics Disclosure via student/stats REST Route

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning a student's learning statistics, allowing unauthenticated attackers to disclose the course counts, points, certificates, quiz and assignment totals of any registered user...

CVE-2026-81196

The MasterStudy LMS WordPress plugin before 3.7.46 fails to properly verify ownership of quiz question identifiers, an IDOR flaw that lets any user with instructor-level access read other instructors' quiz questions, including correct answers and explanations . The CVSS 3.1 score is 2.7 (Low) , r...

CVE-2026-81194 MasterStudy LMS < 3.7.46 - Subscriber+ Cross-Instructor Order Data Disclosure via author_id Parameter

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify authorization when retrieving order line-item data, allowing any authenticated user including Subscribers to read other instructors' course sales records by supplying another user's identifier...

EUVD-2026-69849

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of quiz question identifiers, allowing users with instructor access to read other instructors' quiz questions, including the correct answers and explanations...

WordPress MasterStudy LMS WordPress Plugin plugin < 3.7.46 - Subscriber+ Cross-Instructor Order Data Disclosure vulnerability

Subscriber+ Cross-Instructor Order Data Disclosure vulnerability discovered by Abdullah Kareem in WordPress Plugin MasterStudy LMS versions 3.7.46...

CVE-2026-81194

MasterStudy LMS WordPress Plugin (versions before 3.7.46 ) contains an authorization bypass in its order line-item retrieval endpoint. By supplying another user's identifier (the author_id parameter), any authenticated user—including low-privilege Subscribers —can read other instructors' course s...

CVE-2026-81197 MasterStudy LMS < 3.7.46 - Unauthenticated Unpublished Course Title Disclosure via course-list REST Route

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not restrict access to a REST route that lists an author's courses, nor does it filter that listing by publication status, allowing unauthenticated users to read the titles and IDs of unpublished draft, pending and private...

CVE-2026-81196 MasterStudy LMS < 3.7.46 - Instructor+ Quiz Answer Disclosure via IDOR

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of quiz question identifiers, allowing users with instructor access to read other instructors' quiz questions, including the correct answers and explanations...

CVE-2026-81195 MasterStudy LMS < 3.7.46 - Unauthenticated Student Enrollment Disclosure via student-courses REST Route

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning per-student course enrollment and progress data, allowing unauthenticated attackers to disclose the enrolled courses and learning progress of any registered user...

WordPress MasterStudy LMS WordPress Plugin plugin < 3.7.46 - Instructor+ Quiz Answer Disclosure vulnerability

Instructor+ Quiz Answer Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin MasterStudy LMS versions 3.7.46...

EUVD-2026-69850

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not restrict access to a REST route that lists an author's courses, nor does it filter that listing by publication status, allowing unauthenticated users to read the titles and IDs of unpublished draft, pending and private...

CVE-2026-81197

The MasterStudy LMS WordPress plugin (versions before 3.7.46 ) contains an Unauthenticated Unpublished Course Title Disclosure vulnerability. The plugin's course-list REST route does not restrict access nor filter results by publication status, allowing unauthenticated users to retrieve the title...

EUVD-2026-69848

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning per-student course enrollment and progress data, allowing unauthenticated attackers to disclose the enrolled courses and learning progress of any registered user...

CVE-2026-81195

The MasterStudy LMS WordPress plugin (versions before 3.7.46 ) lacks an authorization check on the student-courses REST route , allowing unauthenticated attackers to retrieve per-student course enrollment and learning progress data for any registered user. The vulnerability was discovered by Abdu...