4.8
Medium
CVE-2026-81026 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.40 does not verify the amount, receiver, currency or…
Description
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.40 does not verify the amount, receiver, currency or status of a payment notification before marking the corresponding order completed, allowing unauthenticated users to complete full-price orders and gain access to paid content by paying only a token amount.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| MasterStudy LMS WordPress Plugin 3.7 | earliest → < 3.7.40 | 3.7.40 |
Other CVEs of MasterStudy LMS WordPress Plugin
The 20 CVEs of MasterStudy LMS WordPress Plugin →
CVE-2026-88849
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.55 does not verify that a user targeted through its…
2.7
Low
CVE-2026-88846
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not check whether user registration is enabled…
5.3
Medium
CVE-2026-88845
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform any capability or nonce checks…
4.3
Medium
CVE-2026-88847
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that a user is enrolled in a course…
4.3
Medium