EUVD-2026-68062
GHSA-26xx-gp3p-fv9p
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack only requires initiating a real checkout and submitting a minimal payment; plugin simply omits amount validation entirely, so no complex bypass technique is needed.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.40 does not verify the amount, receiver, currency or status of a payment notification before marking the corresponding order completed, allowing unauthenticated users to complete full-price orders and gain access to paid content by paying only a token amount.
AnalysisAI
Payment verification bypass in MasterStudy LMS WordPress Plugin before 3.7.40 permits unauthenticated attackers to fraudulently complete full-price course orders by submitting payment webhook notifications with only a token amount. The plugin neglects to validate the transaction amount, receiving account, currency, or payment status before updating order state to completed, granting unauthorized access to paid LMS content. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target WordPress site to run MasterStudy LMS Plugin in a version prior to 3.7.40 with at least one payment gateway configured and active, so that IPN or webhook callbacks are processed by the vulnerable handler. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS score of 4.8 Medium (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) reflects the network-accessible, unauthenticated nature of the flaw tempered by high attack complexity - likely accounting for the need to initiate a real checkout flow and correctly associate a payment notification with a valid order ID using a supported gateway. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade MasterStudy LMS WordPress Plugin to version 3.7.40 or later, which contains the vendor-released patch addressing payment notification validation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated information disclosure in MasterStudy LMS WordPress Plugin before 3.7.46 exposes the titles and IDs of a
Unauthenticated information disclosure in MasterStudy LMS WordPress Plugin (all versions before 3.7.46) exposes per-stud
Unauthenticated information disclosure in MasterStudy LMS WordPress Plugin before 3.7.46 exposes learning statistics for
Open redirect in MasterStudy LMS WordPress Plugin before version 3.7.43 enables unauthenticated attackers to supply an u
Broken object-level authorization in MasterStudy LMS WordPress Plugin before 3.7.46 exposes course sales records of any
Cross-instructor content tampering in MasterStudy LMS WordPress Plugin before 3.7.46 allows authenticated instructor-rol
Instructors in MasterStudy LMS WordPress Plugin versions before 3.7.46 can read quiz questions, correct answers, and exp
MasterStudy LMS WordPress Plugin versions before 3.7.42 expose order billing records - including customer names, email a
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today