EUVD-2026-69850
GHSA-8g5p-hjg4-2rvf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running MasterStudy LMS
-
ExploitSend unauthenticated GET to course-listing REST route
-
ExecutionReceive JSON with unpublished course titles and IDs
-
ImpactEnumerate draft/private course pipeline
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions are required beyond the plugin being installed and active on a WordPress site running a version below 3.7.46. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms fully unauthenticated, low-complexity remote exploitation against default plugin configurations. Exploitation is limited in impact by the nature of the exposed data: only course titles and IDs of unpublished posts are disclosed - no course body content, student records, or credentials are reachable via this flaw. Sites that have no unpublished courses are functionally unaffected in practice, as the endpoint would return an empty or publish-only result set. |
| Impact | The CVSS 5.3 Medium score (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) accurately characterises this as a low-confidentiality, network-reachable disclosure with no integrity or availability impact. The exposed data - unpublished course titles and IDs - is limited in sensitivity; it does not include course content, student data, payment records, or credentials. Real-world risk is therefore constrained: the primary harm is premature disclosure of planned course offerings or draft content, which may carry business or competitive sensitivity. A publicly available exploit exists via WPScan, lowering the bar for opportunistic abuse. No KEV listing indicates no confirmed active exploitation. The combination of trivial exploitability (no authentication, no special configuration) and a low-severity impact produces a moderate practical priority: sites with commercially sensitive course pipelines should patch promptly, while others can treat this as a standard maintenance update. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a standard HTTP GET request to the exposed REST API route on any site running MasterStudy LMS below 3.7.46. The response returns a JSON listing of the targeted author's courses including their titles and IDs regardless of publication status, immediately revealing draft and private course names. A publicly available proof-of-concept on WPScan documents the exact request, making exploitation trivial for any script-kiddie or automated scanner. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
Unauthenticated information disclosure in MasterStudy LMS WordPress Plugin before 3.7.46 exposes the titles and IDs of an author's unpublished courses - including draft, pending, and private posts - through an unprotected REST API endpoint. The affected route performs no access control check and applies no publication-status filter, meaning any unauthenticated network request can enumerate course content that site owners intended to keep hidden. A publicly available proof-of-concept exists per the WPScan advisory; no active exploitation has been confirmed in CISA KEV at time of analysis.
RemediationAI
Update to MasterStudy LMS WordPress Plugin version 3.7.46 or later, which is the vendor-confirmed patched release per the WPScan advisory. The fix is straightforwardly applied through the WordPress admin dashboard (Plugins → Updates) or WP-CLI ('wp plugin update masterstudy-lms'). If an immediate upgrade is not feasible, a compensating control is to block unauthenticated external access to the specific REST route at the web server or WAF layer; however, this may break legitimate front-end functionality that relies on that endpoint and requires identifying the exact route URI from plugin source code. A simpler interim measure is to restrict the site's REST API to authenticated users globally via a filter such as 'rest_authentication_errors', though this will affect all REST-dependent plugin features. Neither workaround is a substitute for patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MasterStudy LMS is a WordPress learning management system plugin that registers custom REST API routes for course management. The vulnerable route, intended to list an author's courses, fails to enforce WordPress's built-in capability or authentication checks on REST endpoints and omits a post-status filter (e.g., limiting results to 'publish' only). WordPress REST API endpoints are publicly reachable by default unless explicitly restricted via 'permission_callback'. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) applies: the root cause is absent access control on a data-retrieval endpoint rather than any memory-corruption or injection flaw. The CPE string identifies the affected product as 'masterstudy_lms_wordpress_plugin' across all versions below 3.7.46.
Know when Masterstudy Lms Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-reachable with no auth or complexity; confidentiality impact is Low (titles/IDs only) with no integrity or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not restrict access to a REST route that lists an author's courses, nor does it filter that listing by publication status, allowing unauthenticated users to read the titles and IDs of unpublished (draft, pending and private) courses.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Authenticated local file inclusion and code execution affects the MasterStudy LMS WordPress plugin in versions from 3.5.
Unauthenticated information disclosure in MasterStudy LMS WordPress Plugin (all versions before 3.7.46) exposes per-stud
Unauthenticated account creation in the MasterStudy LMS WordPress plugin (versions 2.3.0 through before 3.7.50) lets rem
Unauthenticated information disclosure in MasterStudy LMS WordPress Plugin before 3.7.46 exposes learning statistics for
Payment verification bypass in MasterStudy LMS WordPress Plugin before 3.7.40 permits unauthenticated attackers to fraud
Open redirect in MasterStudy LMS WordPress Plugin before version 3.7.43 enables unauthenticated attackers to supply an u
Missing authorization checks in the MasterStudy LMS WordPress plugin before 3.7.50 let any authenticated user - includin
Any authenticated WordPress user - down to the lowest-privilege Subscriber role - can invoke an administrative maintenan
Broken object-level authorization in MasterStudy LMS WordPress Plugin before 3.7.46 exposes course sales records of any
Cross-instructor content tampering in MasterStudy LMS WordPress Plugin before 3.7.46 allows authenticated instructor-rol
Broken object-level authorization in the MasterStudy LMS WordPress plugin before 3.7.50 lets an authenticated user holdi
Broken access control in the MasterStudy LMS WordPress plugin (versions 3.7.13 up to but not including 3.7.55) lets an a
Exploit-DB