EUVD-2026-82658
GHSA-332v-j356-q3mj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Instructor-role account
-
ExploitEnumerate arbitrary order IDs
-
ExecutionCall order-update REST endpoint without ownership check
-
ImpactGrant free enrolment / revoke paid enrolments / tamper notes
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Requires an authenticated account holding the WordPress 'Instructor' role on a site running MasterStudy LMS plugin before 3.7.50; no administrator privileges and no victim user interaction are needed. The flaw is reachable via the plugin's order-management REST API, which fails to perform per-object ownership or capability checks. Limiting factor: the attacker must already possess (or be granted/self-register into) the Instructor role, which is the primary constraint on real-world exploitation; default configurations of the plugin are affected once such an account exists. |
| Impact | This is a genuine but moderate-severity broken-authorization (IDOR) flaw. Signals: CVSS:3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L (vendor score 3.8). A public POC exists (WPScan), a patch is available (3.7.50), but there is NO EPSS score and NO CISA KEV listing provided - status is 'publicly available exploit code exists', not active exploitation. The key CONFLICT: the vendor sets PR:H, yet the description states exploitation only requires the Instructor role, which is a mid-tier registered WordPress role, not an administrator. Instructor should be PR:L, not PR:H - correcting this raises the base score to roughly 5.4. Impact is correctly limited to integrity/availability (grant free enrolments, revoke others' paid enrolments, tamper order notes) with no confidentiality read (C:N). Net: a real but bounded priority - it requires an attacker to already hold an Instructor account, which caps mass exploitability, so treat it as a moderate patch-soon issue rather than an emergency. |
| Exploit ScenarioDerived | An attacker who registers or is granted an Instructor account on a MasterStudy LMS site sends crafted requests to the order-update REST API endpoint referencing order IDs they do not own. Because no per-object ownership or capability check is enforced, they grant themselves free enrolment in paid courses, revoke other students' paid enrolments, and rewrite order notes. A public POC is available via WPScan, lowering the skill needed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 18, 2026
Broken object-level authorization in the MasterStudy LMS WordPress plugin before 3.7.50 lets an authenticated user holding the Instructor role modify any order on the site through the plugin's order REST API, enabling free course enrolment, revocation of other users' paid enrolments, and tampering with order notes. The flaw is an IDOR (CWE-639) reachable remotely over the network with low privileges required and no victim interaction; publicly available exploit code exists, though there is no confirmation of active exploitation (CISA KEV). Our assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) places this at moderate severity, with the Instructor account requirement being the principal real-world constraint.
RemediationAI
Vendor-released patch: upgrade MasterStudy LMS to 3.7.50 or later - this is the only complete fix, since the underlying defect is missing server-side ownership/capability validation in the plugin's order REST handlers. Per the vendor advisory (https://wpscan.com/vulnerability/8006876f-27bb-483d-b4e4-9fa4414d16f0/), the patched release corrects the absent per-object permission checks. Where immediate upgrade is not possible, apply these compensating controls with awareness of their trade-offs: (1) audit and prune Instructor-role accounts, temporarily downgrading them to Student or Subscriber - this preserves the role boundary but degrades legitimate instructor workflows and does not fix the API for any retained Instructor; (2) if the site allows users to self-select or self-register into the Instructor role, disable that path in the plugin/WordPress registration settings immediately, as it is the easiest route to satisfying the attacker prerequisite; (3) block or rate-limit unauthenticated and low-privilege access to the plugin's order REST routes at the WAF/reverse-proxy layer (filtering on the plugin's REST namespace and order endpoints) - this is a blunt control that will break legitimate front-end order operations and must be tested before enforcement; (4) add a short-term mu-plugin filter enforcing current_user_can and order-ownership checks on the order-update route, accepting that custom code must be maintained and re-validated against the vendor patch; (5) monitor order records for unexpected enrolment grants, revoked paid enrolments, or modified order notes, since those are the observable artifacts of exploitation. Note that restricting REST access without upgrading leaves the code-level IDOR in place for any reachable path.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the MasterStudy LMS WordPress plugin, a course-and-commerce extension that manages courses, students, instructors, and paid enrolments through orders processed via its own REST API namespace. The root cause is CWE-639, Authorization Bypass Through User-Controlled Key: order-update handlers accept an order identifier supplied by the client but fail to verify that the requesting user owns that object or holds a capability permitting modification of it. WordPress capability checks (current_user_can) and object-ownership comparisons against order metadata are therefore missing, so authorization degenerates into authentication only. Because the plugin's orders are tightly coupled to enrolment state and payment status, an attacker who can write to arbitrary order records can indirectly grant or revoke course access and alter financial/administrative notes. Note that the CPE data maps the product to an 'unknown' vendor entry (cpe:2.3:a:unknown:masterstudy_lms_wordpress_plugin:*:*:*:*:*:*:*:*), a normalization gap rather than a distinct affected product; the plugin is distributed through the WordPress ecosystem and its stated maintainer, not a CPE-listed vendor.
Know when Masterstudy Lms Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L
Instructor is a mid-tier authenticated role so PR:L (not vendor PR:H); order tampering/free enrolment is I:L and revoking paid enrolments is A:L; no data read so C:N.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free course enrolment, revoking other users' paid enrolments, and tampering with order notes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Authenticated local file inclusion and code execution affects the MasterStudy LMS WordPress plugin in versions from 3.5.
Unauthenticated information disclosure in MasterStudy LMS WordPress Plugin before 3.7.46 exposes the titles and IDs of a
Unauthenticated information disclosure in MasterStudy LMS WordPress Plugin (all versions before 3.7.46) exposes per-stud
Unauthenticated account creation in the MasterStudy LMS WordPress plugin (versions 2.3.0 through before 3.7.50) lets rem
Unauthenticated information disclosure in MasterStudy LMS WordPress Plugin before 3.7.46 exposes learning statistics for
Payment verification bypass in MasterStudy LMS WordPress Plugin before 3.7.40 permits unauthenticated attackers to fraud
Open redirect in MasterStudy LMS WordPress Plugin before version 3.7.43 enables unauthenticated attackers to supply an u
Missing authorization checks in the MasterStudy LMS WordPress plugin before 3.7.50 let any authenticated user - includin
Any authenticated WordPress user - down to the lowest-privilege Subscriber role - can invoke an administrative maintenan
Broken object-level authorization in MasterStudy LMS WordPress Plugin before 3.7.46 exposes course sales records of any
Cross-instructor content tampering in MasterStudy LMS WordPress Plugin before 3.7.46 allows authenticated instructor-rol
Instructors in MasterStudy LMS WordPress Plugin versions before 3.7.46 can read quiz questions, correct answers, and exp
Exploit-DB