CVE-2026-81200 Overview
CVE-2026-81200 is an Insecure Direct Object Reference (IDOR) vulnerability [CWE-639] in the MasterStudy LMS WordPress plugin versions prior to 3.7.42. The plugin fails to enforce authorization checks on order information endpoints. Any authenticated user holding the instructor role can enumerate order IDs and read billing details belonging to other users. Exposed fields include full name, email address, phone number, and postal address. The flaw stems from broken access control rather than authentication weakness, requiring a valid instructor account to exploit.
Critical Impact
Instructor-level accounts can harvest personally identifiable information (PII) from every order stored by the plugin through sequential ID enumeration.
Affected Products
- MasterStudy LMS WordPress Plugin versions prior to 3.7.42
- WordPress sites running the plugin with multiple instructor accounts
- LMS deployments processing paid course orders through the plugin
Discovery Timeline
- 2026-08-29 - CVE-2026-81200 published to NVD
- 2026-08-31 - Last updated in NVD database
Technical Details for CVE-2026-81200
Vulnerability Analysis
The MasterStudy LMS plugin exposes order lookup functionality intended for instructors to view their own transaction records. The affected endpoint accepts an order identifier as a parameter but does not validate that the requesting instructor owns the referenced order. As a result, any instructor can substitute another user's order ID and receive the associated billing record in the response.
Because order IDs are sequential integers, an attacker with instructor access can script enumeration across the full ID range. Each successful request returns a complete billing profile: name, email, phone, and postal address. The vulnerability requires no user interaction from victims and leaves no visible trace in typical WordPress activity logs. Exploitation scales linearly with the number of orders stored in the database.
Root Cause
The root cause is missing object-level authorization on the order retrieval handler. The plugin relies on role-based access control to gate the endpoint but omits the ownership check that would tie a specific order record to the requesting user. This pattern maps directly to [CWE-639: Authorization Bypass Through User-Controlled Key].
Attack Vector
Exploitation requires an authenticated instructor account on the target WordPress site. An attacker either registers as an instructor where self-registration is permitted or compromises an existing instructor credential. The attacker then issues sequential requests to the order endpoint, incrementing the order ID parameter on each request. The plugin returns billing data for orders the attacker does not own.
See the WPScan Vulnerability Details for reference material on the affected endpoint behavior.
Detection Methods for CVE-2026-81200
Indicators of Compromise
- Sequential or high-volume requests to MasterStudy LMS order endpoints from a single authenticated session
- Instructor accounts issuing order lookup requests for IDs outside their known course catalog
- Unusual spikes in HTTP 200 responses to order-related plugin URLs correlated with a single user ID
Detection Strategies
- Review WordPress access logs for repeated requests to MasterStudy LMS order endpoints with incrementing numeric parameters
- Compare requesting instructor IDs against the owning instructor recorded for each returned order
- Alert on any instructor account whose order query volume exceeds the count of orders assigned to that instructor
Monitoring Recommendations
- Enable verbose logging on the WordPress REST API and admin-ajax handlers for the affected plugin paths
- Forward WordPress and web server logs to a centralized SIEM for correlation across sessions
- Track authentication events for instructor accounts and flag logins from new IP ranges or user agents
How to Mitigate CVE-2026-81200
Immediate Actions Required
- Update the MasterStudy LMS WordPress plugin to version 3.7.42 or later
- Audit existing instructor accounts and remove any that are inactive or unrecognized
- Rotate credentials for all instructor accounts and enforce multi-factor authentication on the WordPress admin surface
- Review server logs for prior enumeration activity against order endpoints
Patch Information
The vendor addressed the issue in MasterStudy LMS version 3.7.42. Administrators should install the update through the WordPress plugin manager or by deploying the patched release manually. Refer to the WPScan Vulnerability Details advisory for confirmation of the fixed version.
Workarounds
- Restrict instructor role assignment to trusted staff until the patch is applied
- Disable open self-registration for the instructor role in the plugin settings
- Deploy a web application firewall (WAF) rule to rate-limit and inspect requests to MasterStudy LMS order endpoints
# Configuration example: WP-CLI update to the patched release
wp plugin update masterstudy-lms-learning-management-system --version=3.7.42
wp plugin list --name=masterstudy-lms-learning-management-system --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
