MasterStudy LMS CVE-2026-81339

Exploitation requires an authenticated WordPress account of at least subscriber role on a site running MasterStudy LMS before version 3.7.50 (PR:L); subscriber registration is frequently open on LMS/course sites, lowering this barrier. No user interaction and no special non-default configuration are needed - the missing per-object ownership check exists in the quiz-attempt result path itself. The attacker must reference or enumerate valid attempt identifiers belonging to other users. Impact is limited to reading other students' quiz grades, pass/fail status, and attempt timestamps (confidentiality only); no data can be modified.

This is a genuine but low-severity issue best characterized as a high-visibility-low-real-risk finding. The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately reflects an IDOR (CWE-639) with only a minor confidentiality impact and no integrity or availability effect. Network vector and low complexity are offset by PR:L - a valid authenticated account (WordPress subscriber, which is often self-registerable on LMS sites) is required, and only low-sensitivity data (quiz grades, pass/fail status, attempt timestamps) is exposed. No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence, so there is no signal of active or imminent exploitation; treat exploitation status as no public exploit identified at time of analysis. There are no conflicting signals across sources - the WPScan CVSS, the CWE, and the description are mutually consistent. The one metadata discrepancy is the 'Authentication Bypass' tag, which mislabels an authorization/IDOR flaw (exploitation actually requires being authenticated, not bypassing authentication). Overall this is a routine patch-in-normal-cycle item, not an emergency, despite the plugin's large install base.

An attacker registers or already holds a minimal subscriber-level account on a WordPress site running MasterStudy LMS. They call the quiz-attempt result endpoint while substituting attempt identifiers belonging to other students, and the plugin returns those users' grades, pass/fail status, and timestamps because it never checks per-object ownership. No public exploit code was identified, and the low sensitivity of the data limits impact to privacy leakage of other students' quiz outcomes.