CVE-2026-81197 in MasterStudy LMS Plugin
Summary
by MITRE • 09/02/2026
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not restrict access to a REST route that lists an author's courses, nor does it filter that listing by publication status, allowing unauthenticated users to read the titles and IDs of unpublished (draft, pending and private) courses.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified in MasterStudy LMS WordPress Plugin versions prior to 3.7.46 represents a critical failure in access control mechanisms within the plugin's REST API implementation. Specifically, the endpoint responsible for listing an author's courses lacks sufficient authorization checks and input validation regarding publication status. This architectural flaw allows unauthenticated actors to query the system and retrieve sensitive metadata associated with course content that is intended to remain hidden from public view. The absence of proper enforcement mechanisms means that any individual on the internet can interact with this API endpoint without providing valid credentials or session tokens, bypassing standard WordPress authentication protocols entirely.
From a technical perspective, the core issue lies in how the REST route handles requests for course listings associated with specific authors. Instead of verifying whether the requesting user has administrative privileges or is the actual author of the courses being queried, and more critically, failing to filter results based on post status fields such as draft, pending review, or private visibility settings, the system returns all available records linked to that author ID. This behavior exposes internal development workflows and unpublished educational materials. The vulnerability stems from a lack of strict object-level permissions checks within the REST controller logic, which is a common pitfall in WordPress plugin development when custom endpoints are registered without adhering strictly to capability-based access controls defined by the platform's core security model.
The operational impact of this information disclosure vulnerability is significant for educational institutions and content creators utilizing the MasterStudy LMS. Unpublished courses often contain proprietary curriculum, beta testing materials, or sensitive student data configurations that have not yet been finalized for public release. By exposing course titles and unique identifiers to unauthenticated users, attackers can perform reconnaissance activities to map out an organization's training infrastructure. This information can be leveraged in subsequent attacks, such as targeted social engineering campaigns against instructors or administrators who manage these specific courses. Furthermore, the exposure of internal project structures may reveal strategic business intentions regarding new course offerings before they are officially launched, providing competitors with valuable intelligence.
This vulnerability aligns closely with CWE-284, which describes Improper Access Control, specifically highlighting failures in enforcing restrictions on access to resources by unauthorized actors. Additionally, it maps to the ATT&CK framework under T1078, Valid Accounts, although in this case, no valid account is required due to the lack of authentication checks, and T1592, Gather Victim Host Information, as the attacker collects data about the target environment's structure and content. The failure to filter by publication status also touches upon CWE-200, Exposure of Sensitive Information to an Unauthorized Actor, which classifies this incident as a clear case of information leakage through insecure API design practices.
To mitigate this vulnerability, administrators must upgrade the MasterStudy LMS plugin to version 3.7.46 or later immediately, as this release includes patches that enforce proper access controls and filter course listings by their publication status for non-privileged users. In environments where immediate patching is not feasible due to compatibility concerns with other plugins, temporary mitigations should be implemented at the web server level. This can involve configuring a Web Application Firewall or reverse proxy rules to block direct API requests to the specific REST endpoint associated with course listings from unauthenticated sources. Additionally, developers auditing similar custom WordPress plugins should ensure that all registered REST routes implement appropriate capability checks using functions like current_user_can and verify post status permissions before returning data to prevent unauthorized exposure of draft or private content.