CVE-2026-81340NVD

Description

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free course enrolment, revoking other users' paid enrolments, and tampering with order notes.

Severity Level

UNKNOWN

Published Date

18/09/2026

Last Modified

18/09/2026

Exploitation Status

????

EPSS Score

0.23% (percentile 14.3%)

Affected & Patched Versions

Product	Affected Versions	Patched Version
Unknown MasterStudy LMS WordPress Plugin	0 - < 3.7.50	N/A

📧Email Delivery — Threat intel straight to your inbox.

♾️Unlimited Vendors — Track your entire stack.

🚨All New CVEs — Be the first to know.

⚙️Custom EPSS — Filter noise, focus on risk.

💬Webhooks — Slack & Teams integration.

🚫Ad-Free — Uninterrupted experience.