CVE-2026-81200 — MasterStudy LMS < 3.7.42 - Instructor+ Cross-Tenant Order Billing PII Disclosure via IDOR

CVE-2026-81200

MasterStudy LMS < 3.7.42 - Instructor+ Cross-Tenant Order Billing PII Disclosure via IDOR PUBLISHED

Description (CNA)

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.42 does not correctly restrict access to order information, allowing any user with the instructor role to read other users' order billing details, including name, email address, phone number and postal address, by enumerating order IDs.

Affected (CNA)

Vendor / product	Versions
Unknown / MasterStudy LMS WordPress Plugin	affected 0 before 3.7.42

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/1a4db76f-7043-4f9e-a584-17151d008ab1/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.