CVE-2026-81198 — MasterStudy LMS < 3.7.46 - Instructor+ Cross-Course Curriculum Deletion and Tampering via IDOR

CVE-2026-81198

MasterStudy LMS < 3.7.46 - Instructor+ Cross-Course Curriculum Deletion and Tampering via IDOR PUBLISHED

Description (CNA)

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of a curriculum object before acting on it, allowing authenticated users with the instructor role to delete or modify curriculum sections and materials belonging to courses owned by other instructors.

Affected (CNA)

Vendor / product	Versions
Unknown / MasterStudy LMS WordPress Plugin	affected 0 before 3.7.46

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/424b3a47-78fe-4c95-a317-c1deaf2b7b0c/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.