Insufficient Access Control in MasterStudy LMS WordPress Plugin
CVE-2026-81196

Currently unrated

Key Information:

Vendor

WordPress
Status
Masterstudy Lms WordPress Plugin
Vendor
CVE Published:
2 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-81196?

The MasterStudy LMS WordPress Plugin prior to version 3.7.46 suffers from an insufficient access control vulnerability that allows users with instructor access to view quiz questions, including correct answers and explanations, that belong to other instructors. This vulnerability can lead to unauthorized information disclosure and compromise the integrity of course assessments, making it essential for users to update their plugins promptly to mitigate risks.

Affected Version(s)

MasterStudy LMS WordPress Plugin 0 < 3.7.46

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-81196 - Proof of Concept

References

https://wpscan.com/vulnerability/d11acb84-6dd0-4229-ac30-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Revanth Hari Narayana Matte
WPScan
.