CVE-2026-81340: low-severity vulnerability in MasterStudy LMS WordPress Plugin
MasterStudy LMS < 3.7.50 - Instructor+ Order Status Manipulation via IDOR
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 3.8epss 0.3%
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free course enrolment, revoking other users' paid enrolments, and tampering with order notes.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L
Affected products
Unknown · MasterStudy LMS WordPress Pluginpublic PoCs found — 1
cve_referencewpscan.com/vulnerability/8006876f-27bb-483d-b4e4-9fa4414d16f0/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — MasterStudy LMS WordPress Plugin
In the same product, most dangerous first.
CVE-2023-4278HIGHMasterStudy LMS < 3.0.18 - Unauthenticated Instructor Account CreationEPSS 6.2%CVE-2024-5973CRITICALMasterStudy LMS < 3.3.24 - Privilege Escalation to InstructorEPSS 0.5%CVE-2026-81199MEDIUMMasterStudy LMS < 3.7.46 - Unauthenticated Student Statistics Disclosure via student/stats REST RouteEPSS 0.5%CVE-2026-88843HIGHMasterStudy LMS 3.5.29 - < 3.7.50 - Contributor+ LFI via Elementor Courses Categories WidgetEPSS 0.4%CVE-2026-81197MEDIUMMasterStudy LMS < 3.7.46 - Unauthenticated Unpublished Course Title Disclosure via course-list REST RouteEPSS 0.3%CVE-2026-81195MEDIUMMasterStudy LMS < 3.7.46 - Unauthenticated Student Enrollment Disclosure via student-courses REST RouteEPSS 0.3%