CVE-2026-81340: MasterStudy LMS Auth Bypass Vulnerability

CVE-2026-81340 Overview

CVE-2026-81340 is a broken access control vulnerability in the MasterStudy LMS WordPress plugin versions prior to 3.7.50. The plugin fails to perform per-object ownership or capability checks when updating orders through its REST API. Users with the Instructor role can modify any order on the site. This enables free course enrolment, revocation of other users' paid enrolments, and tampering with order notes. The flaw is classified under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Authenticated Instructor accounts can manipulate any order record, disrupting paid enrolments and granting unauthorized course access across the site.

Affected Products

MasterStudy LMS WordPress Plugin versions prior to 3.7.50
WordPress sites operating the plugin with Instructor-role users provisioned
Learning platforms exposing the plugin's REST API endpoints

Discovery Timeline

2026-09-18 - CVE-2026-81340 published to NVD
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-81340

Vulnerability Analysis

The MasterStudy LMS plugin exposes REST API endpoints for managing course orders. These endpoints accept order identifiers supplied by the caller and process update actions against the referenced records. The implementation does not validate whether the authenticated user owns the target order or holds the capability to modify it. Any user authenticated with the Instructor role can invoke the update endpoint against arbitrary order IDs.

The result is horizontal and vertical authorization bypass across order data. Instructors can enroll themselves or others in paid courses without payment. They can also cancel legitimate enrolments belonging to other students and rewrite the notes attached to any order.

Root Cause

The root cause is a missing authorization check in the REST route handler responsible for order updates. The handler treats the Instructor capability as sufficient for the operation and does not compare the target order's owner against the current user. This pattern matches [CWE-639], where access decisions rely on a user-controlled key without server-side ownership validation.

Attack Vector

Exploitation requires an authenticated Instructor account and network access to the WordPress site. The attacker crafts an HTTP request to the vulnerable REST endpoint, supplies an arbitrary order identifier belonging to another user, and submits the update payload. No user interaction is required from the victim. Refer to the WPScan Vulnerability Report for endpoint-specific details.

Detection Methods for CVE-2026-81340

Indicators of Compromise

REST API requests to MasterStudy LMS order endpoints originating from accounts holding only the Instructor role.
Order records updated with user_id or enrolment fields that do not match the order's original owner.
Unexpected changes to order notes or enrolment status logged outside normal administrative workflows.
Sudden increases in free enrolments for paid courses tied to a single Instructor session.

Detection Strategies

Enable WordPress audit logging on the wp_options, order post types, and REST authentication events tied to the plugin.
Correlate REST endpoint access logs with the acting user's role to flag Instructors mutating orders they do not own.
Alert on anomalous enrolment grants and refund or note edits performed outside the WooCommerce or admin dashboard flow.

Monitoring Recommendations

Ingest WordPress and web server access logs into a centralized analytics platform for role-based query filtering.
Baseline normal Instructor REST activity and alert on deviations targeting order-management routes.
Review order modification history weekly and validate that mutations map to legitimate admin or shop-manager actions.

How to Mitigate CVE-2026-81340

Immediate Actions Required

Upgrade the MasterStudy LMS WordPress plugin to version 3.7.50 or later on all affected sites.
Audit existing orders for unauthorized changes to enrolments, ownership, and notes since the plugin was installed.
Review the Instructor role assignments and remove accounts that are inactive or unnecessary.

Patch Information

The vendor addressed the flaw in MasterStudy LMS version 3.7.50 by adding per-object ownership and capability checks to the affected REST API order-update handler. See the WPScan Vulnerability Report for advisory details.

Workarounds

Temporarily restrict Instructor account creation and require administrator approval for new instructors until patching completes.
Block or rate-limit access to MasterStudy LMS REST order endpoints at the web application firewall for non-administrator roles.
Disable the plugin on sites where an immediate upgrade is not feasible and Instructor accounts exist.

bash

# Example WP-CLI command to verify the installed plugin version
wp plugin get masterstudy-lms-learning-management-system --field=version

# Update the plugin to the fixed release
wp plugin update masterstudy-lms-learning-management-system --version=3.7.50