637 matches found
CVE-2026-81199: Exposure of Sensitive Information to an Unauthorized Actor
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning a student's learning statistics, allowing unauthenticated attackers to disclose the course counts, points, certificates, quiz and assignment totals of any registered user...
CVE-2026-81196: Authorization Bypass Through User-Controlled Key
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of quiz question identifiers, allowing users with instructor access to read other instructors' quiz questions, including the correct answers and explanations...
CVE-2026-81197: Exposure of Sensitive Information to an Unauthorized Actor
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not restrict access to a REST route that lists an author's courses, nor does it filter that listing by publication status, allowing unauthenticated users to read the titles and IDs of unpublished draft, pending and private...
PT-2026-84629
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of quiz question identifiers, allowing users with instructor access to read other instructors' quiz questions, including the correct answers and explanations...
CVE-2026-81195: Exposure of Sensitive Information to an Unauthorized Actor
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning per-student course enrollment and progress data, allowing unauthenticated attackers to disclose the enrolled courses and learning progress of any registered user...
PT-2026-84630
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not restrict access to a REST route that lists an author's courses, nor does it filter that listing by publication status, allowing unauthenticated users to read the titles and IDs of unpublished draft, pending and private...
CVE-2026-81200
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.42 does not correctly restrict access to order information, allowing any user with the instructor role to read other users' order billing details, including name, email address, phone number and postal address, by enumerating order...
CVE-2026-81342
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.43 does not validate a redirect parameter supplied during user registration before using it, allowing unauthenticated attackers to redirect users to arbitrary external URLs...
CVE-2026-81026
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.40 does not verify the amount, receiver, currency or status of a payment notification before marking the corresponding order completed, allowing unauthenticated users to complete full-price orders and gain access to paid content by...
CVE-2026-81026 MasterStudy LMS < 3.7.40 - Unauthenticated Payment Bypass via PayPal IPN
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.40 does not verify the amount, receiver, currency or status of a payment notification before marking the corresponding order completed, allowing unauthenticated users to complete full-price orders and gain access to paid content by...
CVE-2026-81200 MasterStudy LMS < 3.7.42 - Instructor+ Cross-Tenant Order Billing PII Disclosure via IDOR
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.42 does not correctly restrict access to order information, allowing any user with the instructor role to read other users' order billing details, including name, email address, phone number and postal address, by enumerating order...
EUVD-2026-68062
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.40 does not verify the amount, receiver, currency or status of a payment notification before marking the corresponding order completed, allowing unauthenticated users to complete full-price orders and gain access to paid content by...
CVE-2026-81026
The MasterStudy LMS WordPress Plugin (versions before 3.7.40 ) is vulnerable to an Unauthenticated Payment Bypass via PayPal IPN. The plugin fails to verify the amount, receiver, currency, or status of a payment notification before marking an order as completed. This allows unauthenticated users ...
EUVD-2026-68064
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.43 does not validate a redirect parameter supplied during user registration before using it, allowing unauthenticated attackers to redirect users to arbitrary external URLs...
WordPress MasterStudy LMS WordPress Plugin plugin < 3.7.43 - Unauthenticated Open Redirect vulnerability
Unauthenticated Open Redirect vulnerability discovered by Abiodun Victor in WordPress Plugin MasterStudy LMS versions 3.7.43...
CVE-2026-81342
The MasterStudy LMS WordPress Plugin (versions before 3.7.43 ) is vulnerable to an unauthenticated open redirect because it fails to validate a redirect parameter provided during the user registration process. This flaw allows an attacker to redirect users to arbitrary external URLs. No specific ...
CVE-2026-81342 MasterStudy LMS < 3.7.43 - Unauthenticated Open Redirect
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.43 does not validate a redirect parameter supplied during user registration before using it, allowing unauthenticated attackers to redirect users to arbitrary external URLs...
WordPress MasterStudy LMS WordPress Plugin plugin < 3.7.40 - Unauthenticated Payment Bypass vulnerability
Unauthenticated Payment Bypass vulnerability discovered by Abdullah Kareem in WordPress Plugin MasterStudy LMS versions 3.7.40...
EUVD-2026-68063
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.42 does not correctly restrict access to order information, allowing any user with the instructor role to read other users' order billing details, including name, email address, phone number and postal address, by enumerating order...
WordPress MasterStudy LMS WordPress Plugin plugin < 3.7.42 - Instructor+ Cross-Tenant Order Billing PII Disclosure vulnerability
Instructor+ Cross-Tenant Order Billing PII Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin MasterStudy LMS versions 3.7.42...