CVE-2026-81196 Overview
CVE-2026-81196 affects the MasterStudy LMS WordPress plugin in versions before 3.7.46. The plugin fails to verify ownership of quiz question identifiers before returning question data. Users with instructor access can read other instructors' quiz questions, including correct answers and explanations. The flaw maps to CWE-639: Authorization Bypass Through User-Controlled Key, a classic Insecure Direct Object Reference (IDOR) pattern.
Critical Impact
Authenticated instructors can enumerate quiz question IDs belonging to other instructors and retrieve confidential quiz content, undermining assessment integrity across shared learning platforms.
Affected Products
- MasterStudy LMS WordPress Plugin versions before 3.7.46
- WordPress sites running MasterStudy LMS with multi-instructor access
- Learning platforms exposing the plugin's quiz question endpoints to instructor role users
Discovery Timeline
- 2026-09-02 - CVE-2026-81196 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-81196
Vulnerability Analysis
The MasterStudy LMS plugin exposes quiz question data through endpoints that accept a question identifier from the requesting user. The plugin resolves the identifier to a quiz question record and returns the content, including the correct answer and explanation fields. The endpoint checks whether the caller holds instructor capabilities but does not verify that the caller owns the quiz or course associated with the requested question ID.
An authenticated instructor can iterate through question IDs and retrieve records created by other instructors. Because quiz question identifiers are sequential integers, enumeration is straightforward. The returned payload discloses answer keys and explanatory text that instructors normally keep private for assessment integrity.
Root Cause
The root cause is missing object-level authorization. The plugin trusts the user-controlled question_id parameter and performs only role-level checks. It does not compare the question's owning instructor or course against the authenticated user. This is the pattern described by CWE-639.
Attack Vector
Exploitation requires an authenticated account with instructor privileges on the target WordPress site. The attacker sends requests to the vulnerable quiz question endpoint with incremented or guessed identifiers. The server returns question text, correct answers, and explanations belonging to other instructors. No user interaction from the victim is required.
No verified public proof-of-concept code is available. See the WPScan Vulnerability Analysis for technical details.
Detection Methods for CVE-2026-81196
Indicators of Compromise
- Sequential or high-volume requests from a single authenticated instructor account to MasterStudy LMS quiz question endpoints.
- Access log entries where an instructor retrieves question IDs not linked to any course they own or teach.
- Unexplained appearance of another instructor's quiz content in exports, downloads, or duplicated courses.
Detection Strategies
- Correlate WordPress authentication logs with plugin REST or AJAX request paths that reference question_id parameters, and flag enumeration patterns.
- Compare the requesting user ID against the owning instructor of each returned question by joining plugin database tables in an audit query.
- Alert on instructor accounts that read a broad range of question IDs within a short window.
Monitoring Recommendations
- Enable verbose logging for MasterStudy LMS AJAX and REST endpoints and forward the logs to a centralized analytics pipeline.
- Monitor the wp_stmlms_* tables and audit read patterns per instructor role account.
- Review new or recently promoted instructor accounts for anomalous quiz question access volume.
How to Mitigate CVE-2026-81196
Immediate Actions Required
- Update the MasterStudy LMS WordPress plugin to version 3.7.46 or later on all affected WordPress sites.
- Audit instructor accounts for unfamiliar users and revoke access for any account that should not hold instructor capabilities.
- Review recent quiz question access logs to identify potential unauthorized reads before the patch was applied.
Patch Information
Upgrade MasterStudy LMS to version 3.7.46 or later. The vendor advisory and technical detail are published on the WPScan Vulnerability Analysis page. Verify the plugin version in the WordPress admin plugins screen after upgrade.
Workarounds
- Restrict instructor role assignment to trusted users only until the patch is applied.
- Temporarily disable the MasterStudy LMS plugin on sites that cannot upgrade immediately if quiz confidentiality is critical.
- Rotate or regenerate quiz questions and answers that may have been exposed to other instructors before patching.
# Verify installed MasterStudy LMS version via WP-CLI
wp plugin get masterstudy-lms-learning-management-system --field=version
# Update the plugin to the patched release
wp plugin update masterstudy-lms-learning-management-system --version=3.7.46
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
