CVE-2026-81194 Overview
CVE-2026-81194 is an authorization flaw in the MasterStudy LMS WordPress plugin before version 3.7.46. The plugin fails to verify authorization when retrieving order line-item data. Any authenticated user, including low-privilege Subscribers, can supply another user's identifier to read other instructors' course sales records. The weakness is classified as an Insecure Direct Object Reference [CWE-639].
Critical Impact
Authenticated attackers with Subscriber-level access can enumerate other instructors' order line-item data, exposing course sales history and revenue records without any elevated privileges.
Affected Products
- MasterStudy LMS WordPress Plugin versions prior to 3.7.46
- WordPress sites running MasterStudy LMS with authenticated user registration enabled
- Learning management deployments exposing instructor sales endpoints
Discovery Timeline
- 2026-09-02 - CVE-2026-81194 published to the National Vulnerability Database
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-81194
Vulnerability Analysis
The vulnerability resides in the MasterStudy LMS endpoint that returns order line-item data for a given user identifier. The plugin accepts a user ID parameter from the request without checking whether the calling user owns the referenced records. As a result, an authenticated actor can substitute any other user's identifier and receive their course sales data.
Because the plugin exposes the endpoint to all logged-in roles, exploitation requires only the lowest tier of WordPress account. Sites that permit open registration are effectively exposing this data to the internet. The data returned includes revenue-relevant details tied to individual instructors.
Root Cause
The root cause is a missing authorization check on a request parameter that references another user's resource. The plugin trusts the supplied identifier instead of comparing it to the authenticated user's own ID or the seller relationship. This matches the pattern described by CWE-639: Authorization Bypass Through User-Controlled Key.
Attack Vector
An attacker registers or logs in to the WordPress site as a Subscriber. The attacker then issues a request to the vulnerable order line-item endpoint and substitutes a target instructor's user identifier. The server returns the target's sales records because it does not enforce ownership. No user interaction from the victim is required.
No verified public exploit code is available. Refer to the WPScan Vulnerability Report for technical details on the vulnerable endpoint.
Detection Methods for CVE-2026-81194
Indicators of Compromise
- Unexpected authenticated requests to MasterStudy LMS order or instructor sales endpoints from Subscriber accounts
- Sequential or enumerated user_id values in request parameters targeting LMS AJAX or REST routes
- Newly registered Subscriber accounts issuing requests to instructor-scoped data endpoints shortly after registration
Detection Strategies
- Review web server and WordPress access logs for repeated requests to MasterStudy LMS endpoints with varying user identifier parameters
- Correlate low-privilege session activity with access to endpoints that return instructor or order data
- Deploy a web application firewall rule that flags Subscriber-role requests carrying user_id values that do not match the session owner
Monitoring Recommendations
- Monitor for spikes in authenticated traffic to /wp-admin/admin-ajax.php and REST routes tied to stm-lms or MasterStudy handlers
- Alert on account registrations followed by immediate access to instructor-scoped endpoints
- Track outbound data volumes from LMS endpoints returning order line-item structures
How to Mitigate CVE-2026-81194
Immediate Actions Required
- Upgrade the MasterStudy LMS WordPress plugin to version 3.7.46 or later on all affected sites
- Audit existing WordPress user accounts and remove untrusted Subscriber accounts created during the exposure window
- Review order and sales data access logs for evidence of enumeration prior to patching
Patch Information
The vendor addressed the missing authorization check in MasterStudy LMS version 3.7.46. Administrators should update the plugin through the WordPress plugin manager or by deploying the updated package manually. Verify the installed version after upgrade to confirm remediation. See the WPScan Vulnerability Report for advisory details.
Workarounds
- Temporarily disable open user registration on WordPress sites running vulnerable plugin versions
- Restrict access to MasterStudy LMS AJAX and REST endpoints at the web application firewall for non-instructor roles
- Deactivate the MasterStudy LMS plugin until the update to 3.7.46 can be validated in staging
# Verify installed MasterStudy LMS plugin version using WP-CLI
wp plugin get masterstudy-lms-learning-management-system --field=version
# Update the plugin to the patched release
wp plugin update masterstudy-lms-learning-management-system --version=3.7.46
# Disable open registration as a temporary hardening step
wp option update users_can_register 0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
