CVE-2026-81199: MasterStudy LMS Information Disclosure Flaw

CVE-2026-81199 Overview

CVE-2026-81199 is an information disclosure vulnerability in the MasterStudy LMS WordPress plugin versions before 3.7.46. The plugin fails to perform an authorization check before returning a student's learning statistics. Unauthenticated attackers can retrieve course counts, points, certificates, and quiz and assignment totals for any registered user on affected sites.

The flaw is classified under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor). Exploitation requires no authentication, no user interaction, and can be performed remotely over the network.

Critical Impact
Unauthenticated remote attackers can enumerate learning statistics of any registered user, exposing student activity data across the entire LMS installation.

Affected Products

MasterStudy LMS WordPress Plugin versions prior to 3.7.46
WordPress sites running the affected plugin versions
Learning management deployments exposing student user data via the plugin's endpoints

Discovery Timeline

2026-09-02 - CVE-2026-81199 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-81199

Vulnerability Analysis

The MasterStudy LMS plugin exposes an endpoint that returns learning statistics for a specified user. The endpoint accepts a user identifier and returns aggregated learning data including course counts, points earned, certificates awarded, and totals for quizzes and assignments.

The vulnerability results from a missing authorization check on this endpoint. The plugin does not verify whether the requester is authenticated, whether the requester is the target user, or whether the requester holds an administrative role. Any remote party can query statistics for any registered user by iterating identifiers.

While the disclosed data is limited to learning progress metrics, it enables user enumeration and profiling of student activity across the platform.

Root Cause

The root cause is missing access control on the statistics endpoint. The plugin developers implemented a data-return function without gating it behind a WordPress capability check, nonce verification, or ownership comparison between the current user and the requested user identifier.

Attack Vector

An attacker sends unauthenticated HTTP requests to the vulnerable endpoint, varying the user identifier parameter to enumerate statistics across all registered accounts. No credentials, session, or prior interaction are required. Refer to the WPScan Vulnerability Detail for endpoint specifics.

Detection Methods for CVE-2026-81199

Indicators of Compromise

Repeated unauthenticated requests to MasterStudy LMS AJAX or REST endpoints handling student statistics
Sequential enumeration patterns targeting incrementing user_id parameter values
Unusual spikes in HTTP traffic to /wp-admin/admin-ajax.php or /wp-json/ paths referencing MasterStudy LMS actions

Detection Strategies

Inspect web server access logs for high-volume unauthenticated calls to MasterStudy LMS endpoints returning user statistics
Alert on requests where the same source IP queries statistics for many distinct user identifiers within a short window
Deploy a Web Application Firewall (WAF) rule to flag requests to the vulnerable endpoint that lack an authenticated session cookie

Monitoring Recommendations

Monitor the MasterStudy LMS plugin version across all WordPress installations and flag versions below 3.7.46
Track outbound response sizes on statistics endpoints to identify bulk data extraction attempts
Correlate WordPress user enumeration attempts with subsequent login or password reset activity

How to Mitigate CVE-2026-81199

Immediate Actions Required

Upgrade the MasterStudy LMS WordPress plugin to version 3.7.46 or later immediately
Audit web server logs for prior unauthenticated access to the affected statistics endpoint
Notify users whose learning statistics may have been exposed if evidence of enumeration is found

Patch Information

The vendor addressed the vulnerability in MasterStudy LMS WordPress Plugin version 3.7.46 by adding the missing authorization check to the statistics endpoint. Site administrators should apply the update through the WordPress plugin dashboard or by replacing the plugin files. See the WPScan Vulnerability Detail for advisory context.

Workarounds

Restrict access to the vulnerable endpoint at the web server or WAF layer until the patch is applied
Temporarily disable the MasterStudy LMS plugin if immediate patching is not feasible
Require authentication at the reverse proxy for admin-ajax.php actions associated with the plugin

bash

# Example nginx rule to block unauthenticated access to the vulnerable action
location = /wp-admin/admin-ajax.php {
    if ($arg_action ~* "stm_lms_get_user_statistics") {
        if ($http_cookie !~* "wordpress_logged_in") {
            return 403;
        }
    }
}