CVE-2026-81194 — MasterStudy LMS < 3.7.46 - Subscriber+ Cross-Instructor Order Data Disclosure via author_id Parameter

CVE-2026-81194

MasterStudy LMS < 3.7.46 - Subscriber+ Cross-Instructor Order Data Disclosure via author_id Parameter PUBLISHED

Description (CNA)

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify authorization when retrieving order line-item data, allowing any authenticated user including Subscribers to read other instructors' course sales records by supplying another user's identifier.

Affected (CNA)

Vendor / product	Versions
Unknown / MasterStudy LMS WordPress Plugin	affected 0 before 3.7.46

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/727903d4-ce0f-4ab4-bbd4-c973091e0b8f/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.