CVE-2026-81195: MasterStudy LMS Information Disclosure Flaw

CVE-2026-81195 Overview

CVE-2026-81195 is an information disclosure vulnerability in the MasterStudy LMS WordPress plugin versions before 3.7.46. The plugin fails to perform an authorization check before returning per-student course enrollment and progress data. Unauthenticated attackers can query the affected endpoint remotely to disclose the enrolled courses and learning progress of any registered user.

The issue is categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. While the flaw does not affect integrity or availability, it exposes student learning data on any WordPress site running the vulnerable plugin.

Critical Impact
Unauthenticated remote attackers can enumerate enrollment and learning progress for any registered MasterStudy LMS user, exposing student-level activity data.

Affected Products

MasterStudy LMS WordPress Plugin versions prior to 3.7.46
WordPress sites running the affected plugin versions
Learning management deployments exposing the plugin's REST endpoints

Discovery Timeline

2026-09-02 - CVE-2026-81195 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-81195

Vulnerability Analysis

The MasterStudy LMS plugin exposes functionality that returns course enrollment and progress data for individual students. The affected endpoint returns per-student data without validating whether the requesting entity is authenticated or authorized to access that user's records.

As a result, an attacker can iterate through user identifiers and retrieve enrollment history and learning progress for any registered account. The attack requires no credentials, no user interaction, and can be performed remotely over the network.

The vulnerability does not permit modification of data or denial of service. The impact is confined to confidentiality of student-level learning data. Refer to the WPScan Vulnerability Report for additional technical context.

Root Cause

The root cause is a missing authorization check on a data-returning code path. The plugin accepts a user identifier as input and returns enrollment and progress records without verifying that the caller has permission to view records belonging to that identifier. This is a classic broken access control pattern described by CWE-200.

Attack Vector

Exploitation is performed over the network against the WordPress site hosting the vulnerable plugin. An unauthenticated attacker sends a crafted request to the affected plugin endpoint, specifying a target user identifier. The server responds with the target user's enrolled courses and progress data. Attackers can automate enumeration across the full range of registered users to harvest data at scale. See the WPScan advisory for reference details.

Detection Methods for CVE-2026-81195

Indicators of Compromise

Unauthenticated HTTP requests to MasterStudy LMS plugin endpoints returning per-user enrollment or progress data
High-volume sequential requests iterating through user_id or similar identifier parameters
Anomalous traffic volume from single source IPs targeting /wp-json/ or /wp-admin/admin-ajax.php paths associated with the plugin

Detection Strategies

Review web server access logs for repeated requests to MasterStudy LMS routes without authenticated session cookies
Correlate request patterns that enumerate integer parameters against plugin endpoints returning JSON payloads
Deploy WordPress security plugins or a web application firewall (WAF) with signatures for known MasterStudy LMS enumeration patterns

Monitoring Recommendations

Baseline normal request volume to plugin REST endpoints and alert on statistical anomalies
Monitor for user-agent strings associated with automated scraping or scanning tools
Track outbound data volumes from the WordPress host to detect bulk exfiltration of student records

How to Mitigate CVE-2026-81195

Immediate Actions Required

Update the MasterStudy LMS WordPress plugin to version 3.7.46 or later immediately
Audit web server logs for prior unauthenticated access to plugin endpoints returning student data
Notify affected users if evidence of enumeration is discovered during log review

Patch Information

The vendor addressed the missing authorization check in MasterStudy LMS version 3.7.46. Administrators should apply the update through the WordPress plugin dashboard or by downloading the fixed release from the vendor's official distribution channel. Consult the WPScan Vulnerability Report for the patched version reference.

Workarounds

Restrict access to affected plugin endpoints at the WAF or reverse proxy layer until the patch is applied
Temporarily disable the MasterStudy LMS plugin if immediate patching is not feasible and business operations permit
Enforce authentication requirements on /wp-json/ routes using access control rules where possible

bash

# Example WAF rule to block unauthenticated access to MasterStudy LMS REST endpoints
# Adjust path prefix to match the specific plugin route in your deployment
location ~ ^/wp-json/stm-lms/ {
    if ($http_cookie !~ "wordpress_logged_in") {
        return 403;
    }
}