CVE-2026-81199 in MasterStudy Plugin
Summary
by MITRE • 09/02/2026
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning a student's learning statistics, allowing unauthenticated attackers to disclose the course counts, points, certificates, quiz and assignment totals of any registered user.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified in MasterStudy LMS versions prior to 3.7.46 represents a critical failure in access control mechanisms within the WordPress plugin ecosystem. This flaw specifically affects how the application handles requests for student learning statistics, exposing sensitive educational data to unauthenticated actors. The core issue lies in the absence of proper authorization checks before processing and returning user-specific metrics such as course counts, points earned, certificates obtained, and totals for quizzes and assignments. In a secure implementation, any request retrieving personal or role-based information must verify that the requesting entity has explicit permission to access that data, typically by validating session tokens, cookies, or API keys associated with an authenticated user account. The lack of this verification step creates a direct path for unauthorized data retrieval.
From a technical perspective, this vulnerability is classified under CWE-284, which describes Improper Access Control. It also aligns closely with OWASP Top 10 categories related to Broken Access Control and Insecure Direct Object References (IDOR), as the attacker can likely manipulate parameters such as user IDs or session identifiers to retrieve data belonging to other users without possessing valid credentials for those accounts. The vulnerability allows unauthenticated attackers, meaning no login is required to exploit this flaw. By sending specific HTTP requests to the affected endpoints, an external actor can extract detailed learning statistics of any registered user on the platform. This includes granular details about their academic progress and achievements, which are considered sensitive personal information under many data protection regulations including GDPR and CCPA due to their potential use in profiling or social engineering attacks.
The operational impact of this vulnerability extends beyond simple privacy violations. The disclosure of course counts, points, certificates, and quiz totals can be leveraged by attackers for targeted phishing campaigns, corporate espionage if the LMS is used by educational institutions with proprietary research data, or reputational damage to both individual students and the institution hosting the platform. Furthermore, this information leakage aids in reconnaissance activities where adversaries map out user engagement levels, identifying high-value targets based on their activity metrics. The ease of exploitation due to the lack of authentication requirements significantly lowers the barrier for entry, allowing even low-skilled threat actors to execute these attacks using automated tools or simple script requests.
To mitigate this vulnerability, administrators must immediately update the MasterStudy LMS plugin to version 3.7.46 or later, where the authorization checks have been properly implemented. Until an upgrade is feasible, temporary mitigations may include restricting access to the affected API endpoints via web application firewall rules that require valid session cookies for any request targeting student statistics endpoints. Additionally, implementing rate limiting on these endpoints can help reduce the impact of automated scanning attempts. Regular security audits and penetration testing should be conducted to ensure that similar authorization gaps do not exist in other parts of the WordPress plugin architecture, ensuring compliance with industry standards such as CWE-284 for access control integrity.