637 matches found
CVE-2026-81200
The MasterStudy LMS WordPress plugin (versions before 3.7.42 ) contains an IDOR (Insecure Direct Object Reference) vulnerability. Due to insufficient access control, any user assigned the instructor role can access and read other users' order billing details—including names, email addresses, phon...
CVE-2026-81342 MasterStudy LMS < 3.7.43 - Unauthenticated Open Redirect
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.43 does not validate a redirect parameter supplied during user registration before using it, allowing unauthenticated attackers to redirect users to arbitrary external URLs...
CVE-2026-81026 MasterStudy LMS < 3.7.40 - Unauthenticated Payment Bypass via PayPal IPN
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.40 does not verify the amount, receiver, currency or status of a payment notification before marking the corresponding order completed, allowing unauthenticated users to complete full-price orders and gain access to paid content by...
CVE-2026-81200 MasterStudy LMS < 3.7.42 - Instructor+ Cross-Tenant Order Billing PII Disclosure via IDOR
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.42 does not correctly restrict access to order information, allowing any user with the instructor role to read other users' order billing details, including name, email address, phone number and postal address, by enumerating order...
CVE-2026-81342: URL Redirection to Untrusted Site
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.43 does not validate a redirect parameter supplied during user registration before using it, allowing unauthenticated attackers to redirect users to arbitrary external URLs...
PT-2026-83414
Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress Plugin versions prior to 3.7.40 Description An issue exists where the plugin fails to verify the amount, receiver, currency, or status of a payment notification before marking an order as completed. This allows...
CVE-2026-81026: Improper Access Control
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.40 does not verify the amount, receiver, currency or status of a payment notification before marking the corresponding order completed, allowing unauthenticated users to complete full-price orders and gain access to paid content by...
CVE-2026-81200: Authorization Bypass Through User-Controlled Key
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.42 does not correctly restrict access to order information, allowing any user with the instructor role to read other users' order billing details, including name, email address, phone number and postal address, by enumerating order...
PT-2026-83416
Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress Plugin versions prior to 3.7.43 Description An open redirect issue exists during the user registration process. The plugin fails to validate a redirect parameter before utilizing it, which allows unauthenticated...
PT-2026-83415
Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress Plugin versions prior to 3.7.42 Description An Insecure Direct Object Reference IDOR exists where the plugin fails to correctly restrict access to order information. This allows users with the instructor role to acces...
EUVD-2026-65159
Unauthenticated Arbitrary File Deletion in MasterStudy LMS = 3.7.42 versions...
CVE-2026-78284
Unauthenticated Arbitrary File Deletion in MasterStudy LMS = 3.7.42 versions...
CVE-2026-78284 WordPress MasterStudy LMS plugin <= 3.7.42 - Arbitrary File Deletion vulnerability
Unauthenticated Arbitrary File Deletion in MasterStudy LMS = 3.7.42 versions...
CVE-2026-78284
CVE-2026-78284 is an unauthenticated arbitrary file deletion vulnerability in the MasterStudy LMS WordPress plugin, affecting versions 3.7.42 and earlier . An attacker can delete files on the server without any authentication or user interaction. The CVSS 3.1 base score is 8.6 (HIGH) , driven by ...
CVE-2026-78284 WordPress MasterStudy LMS plugin <= 3.7.42 - Arbitrary File Deletion vulnerability
Unauthenticated Arbitrary File Deletion in MasterStudy LMS = 3.7.42 versions...
WordPress MasterStudy LMS plugin <= 3.7.42 - Arbitrary File Deletion vulnerability
Arbitrary File Deletion vulnerability discovered by 20kilograma in WordPress Plugin MasterStudy LMS versions = 3.7.42...
PT-2026-81063
Unauthenticated Arbitrary File Deletion in MasterStudy LMS = 3.7.42 versions...
CVE-2026-78284: Improper Limitation of a Pathname to a Restricted Directory
Unauthenticated Arbitrary File Deletion in MasterStudy LMS = 3.7.42 versions...