Skip to content
fr Sign in
5.3 Medium

CVE-2026-81197 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not restrict access to a REST route that lists…

Description

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not restrict access to a REST route that lists an author's courses, nor does it filter that listing by publication status, allowing unauthenticated users to read the titles and IDs of unpublished (draft, pending and private) courses.

Affected products and versions

Product Affected versions Fixed in
MasterStudy LMS WordPress Plugin 3.7 earliest → < 3.7.46 3.7.46

References

Timeline

  1. Published
  2. Last modified

Other CVEs of MasterStudy LMS WordPress Plugin

The 20 CVEs of MasterStudy LMS WordPress Plugin →
CVE-2026-88849 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.55 does not verify that a user targeted through its… 2.7 Low CVE-2026-88846 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not check whether user registration is enabled… 5.3 Medium CVE-2026-88845 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform any capability or nonce checks… 4.3 Medium CVE-2026-88847 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that a user is enrolled in a course… 4.3 Medium
Track this CVE