MasterStudy LMS CVE-2026-81026

Exploitation requires the target WordPress site to run MasterStudy LMS Plugin in a version prior to 3.7.40 with at least one payment gateway configured and active, so that IPN or webhook callbacks are processed by the vulnerable handler. The attacker must be able to initiate a checkout flow to generate a valid order ID and must have network access to the plugin's payment callback endpoint. A minimal but real payment through a supported gateway is required - the attacker pays a token amount, not zero, since the gateway itself must issue a callback. Limiting factors include: the attacker must register and initiate checkout on the target site; a supported payment gateway must be enabled; and the attacker must be able to complete a real (if trivially cheap) payment transaction. No elevated authentication beyond site registration is required.

The vendor CVSS score of 4.8 Medium (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) reflects the network-accessible, unauthenticated nature of the flaw tempered by high attack complexity - likely accounting for the need to initiate a real checkout flow and correctly associate a payment notification with a valid order ID using a supported gateway. EPSS at 0.15% (4th percentile) is notably low despite public POC availability, suggesting the exploit requires sufficient setup to discourage mass opportunistic exploitation. The bounded impact metrics (C:L/I:L) accurately reflect the harm scope - unauthorized access to paid course content and fraudulent order completion - rather than full system compromise. This is primarily a financial and business integrity risk: operators lose direct revenue per exploited enrollment, and paid course material may be redistributed. There is no CISA KEV listing, meaning active widespread exploitation is not confirmed. Despite the low EPSS, IPN bypass attacks are well-understood and the public POC lowers the skill floor, making unpatched operators facing real if not imminent risk.

An attacker creates an account on a vulnerable LMS site, initiates a checkout for a premium course, and records the resulting order ID. They make a minimal payment (e.g., a few cents) through a configured gateway; the gateway fires a legitimate webhook to the plugin's callback endpoint. Because the plugin does not validate the payment amount against the order total, it marks the full-price order complete and grants the attacker unrestricted access to paid course content. A public proof-of-concept is available via WPScan.