3.8
Low
CVE-2026-81340 The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability…
Description
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free course enrolment, revoking other users' paid enrolments, and tampering with order notes.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| MasterStudy LMS WordPress Plugin 3.7 | earliest → < 3.7.50 | 3.7.50 |
Other CVEs of MasterStudy LMS WordPress Plugin
The 20 CVEs of MasterStudy LMS WordPress Plugin →
CVE-2026-88849
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.55 does not verify that a user targeted through its…
2.7
Low
CVE-2026-88845
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform any capability or nonce checks…
4.3
Medium
CVE-2026-88846
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not check whether user registration is enabled…
5.3
Medium
CVE-2026-88843
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not validate one of its display-style settings…
7.2
High