CVE-2026-81340

LOWCVSS 3.8

Description

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free course enrolment, revoking other users' paid enrolments, and tampering with order notes.

Timeline

Published:September 18th, 2026 6:16 AM

Last modified:September 18th, 2026 7:08 PM

CVSS Scoring

CVSS v3: 3.8 (LOW)

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L

Weaknesses (CWE)

CWE-639

References & Reports

Advisories, patches, and third-party reports

https://wpscan.com/vulnerability/8006876f-27bb-483d-b4e4-9fa4414d16f0/

Source: NIST NVD · Data may lag official sources by up to one minute