MasterStudy LMS CVE-2026-81194

Exploitation requires a valid WordPress account at subscriber level or above - a role freely obtainable on sites that allow public registration, or purchasable by enrolling in any free course. The attacker must supply a valid target user identifier, which can be enumerated via WordPress's predictable integer user IDs or the REST API author endpoint if not separately hardened. No special plugin configuration, elevated role, or admin interaction is required. Limiting factors: sites with closed registration (no public account creation) significantly raise the bar; sites that disable the WordPress REST API user enumeration endpoint reduce ID discoverability, though not the vulnerability itself.

The CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately reflects a limited-scope, read-only authorization bypass. The attack vector is network-reachable, complexity is low, and only subscriber-level authentication is required, making the issue broadly exploitable on any multi-user WordPress site running the plugin. Confidentiality impact is narrow - only order line-item data (course sales records) is exposed, not credentials, payment card details, or site-wide admin data. No integrity or availability impact exists. A publicly available exploit lowers the effort bar further, though the absence of CISA KEV listing indicates no confirmed mass exploitation at time of analysis. EPSS data is not present in the input. The vulnerability is a genuine priority for any e-learning operator running multi-instructor installations because competitor instructors or disgruntled students with free accounts could harvest sales intelligence about other instructors. The patch to 3.7.46 is straightforward and should be applied promptly.

An attacker registers a free subscriber account on a WordPress e-learning site running MasterStudy LMS prior to 3.7.46. They then call the plugin's order line-item API endpoint, substituting a target instructor's user ID in place of their own, and receive that instructor's course sales records including purchase counts and revenue data. A publicly available exploit demonstrates this enumeration, making automated harvesting of all instructor IDs feasible.