CVE-2026-81197 Overview
CVE-2026-81197 affects the MasterStudy LMS WordPress plugin in versions before 3.7.46. The plugin exposes a REST route that lists an author's courses without restricting access or filtering by publication status. Unauthenticated attackers can query the endpoint and retrieve titles and IDs of unpublished courses, including drafts, pending items, and private entries. The issue is classified under [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.
Critical Impact
Unauthenticated remote attackers can enumerate non-public course metadata, exposing draft curriculum, internal course identifiers, and pending content across affected WordPress sites.
Affected Products
- MasterStudy LMS WordPress Plugin versions prior to 3.7.46
- WordPress installations running the vulnerable plugin
- Learning management sites relying on the plugin's REST API for course listings
Discovery Timeline
- 2026-09-02 - CVE-2026-81197 published to the National Vulnerability Database (NVD)
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-81197
Vulnerability Analysis
The MasterStudy LMS plugin registers a REST API route that returns the courses associated with a given author. The endpoint does not enforce authentication or capability checks, and it does not filter results by the WordPress post_status field. As a result, the response includes courses in draft, pending, and private states alongside published content.
An unauthenticated attacker can iterate over author IDs and invoke the REST route directly. Each response reveals course titles and internal IDs that WordPress normally restricts to editors and administrators. The disclosed identifiers can support further reconnaissance against private course pages and unpublished lesson content.
Root Cause
The root cause is a missing authorization check combined with an unfiltered query. The plugin uses a REST callback that queries course posts by author without applying a post_status restriction. WordPress permission_callback for the route returns permissively, so any client can read the results without a valid nonce or session.
Attack Vector
Exploitation requires only network access to the target WordPress site. The attacker sends an HTTP GET request to the vulnerable REST endpoint, supplying an author identifier. The server responds with a JSON payload containing course objects regardless of their publication status. No user interaction, credentials, or elevated privileges are required. Refer to the WPScan Vulnerability Report for endpoint-level technical detail.
Detection Methods for CVE-2026-81197
Indicators of Compromise
- Repeated unauthenticated GET requests to MasterStudy LMS REST routes enumerating sequential author IDs
- Access log entries showing anonymous clients pulling course listings at high frequency
- Outbound references or scraper traffic containing draft course titles that were never published
Detection Strategies
- Audit WordPress access logs for /wp-json/ requests targeting MasterStudy LMS course endpoints from unauthenticated sources
- Compare REST API responses against the published course catalog to identify leakage of draft or private courses
- Alert on spikes in anonymous REST traffic correlated with author ID enumeration patterns
Monitoring Recommendations
- Enable verbose logging on the WordPress REST API layer, including source IP, user agent, and endpoint path
- Forward web server and WordPress logs to a centralized analytics platform for anomaly detection
- Track plugin version inventory across managed WordPress fleets to identify hosts still running versions below 3.7.46
How to Mitigate CVE-2026-81197
Immediate Actions Required
- Upgrade the MasterStudy LMS WordPress plugin to version 3.7.46 or later on every affected site
- Review recent access logs for enumeration of the vulnerable REST route and identify exposed draft content
- Rotate any sensitive identifiers or unpublished course material that must remain confidential after disclosure
Patch Information
The vendor addressed the flaw in MasterStudy LMS WordPress plugin version 3.7.46. The fix restricts the vulnerable REST route and filters results to published courses. Administrators should apply the update through the WordPress plugin manager or by deploying the updated plugin package. See the WPScan Vulnerability Report for confirmation of the fixed version.
Workarounds
- Restrict access to the MasterStudy LMS REST endpoints at the web application firewall until the plugin is upgraded
- Deny unauthenticated requests to /wp-json/ routes associated with course listings by author
- Temporarily disable the MasterStudy LMS plugin on production sites that cannot immediately deploy version 3.7.46
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
