Improper Access Control in MasterStudy LMS WordPress Plugin
CVE-2026-81340
Currently unrated
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 18 September 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-81340?
The MasterStudy LMS WordPress Plugin prior to version 3.7.50 exhibits inadequate access control measures when interacting with its REST API. Specifically, users with the Instructor role can bypass necessary ownership and capability checks, enabling them to alter any order on the system. This flaw permits unauthorized enrollment in courses at no charge, reversal of payments for other users, and manipulation of order notes, posing significant risks to platform integrity and financial security.
Affected Version(s)
MasterStudy LMS WordPress Plugin 0 < 3.7.50
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.