WordPress Plugin Vulnerabilities

MasterStudy LMS 3.6.2 - < 3.7.50 - Instructor+ Student PII Disclosure via IDOR

Description

The plugin does not verify that the requesting user owns the course before returning its enrolled-student data, allowing users with the plugin's Instructor role to disclose the names and email addresses of students enrolled in other instructors' courses.

Proof of Concept

Affects Plugins

Plugin icon
masterstudy-lms-learning-management-system
Fixed in 3.7.50

References

CVE
CVE-2026-88844

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
2.7 (low)

Miscellaneous

Original Researcher
Karthik Ramakrishnan
Submitter
Karthik Ramakrishnan
Verified
Yes
WPVDB ID
13b4f5c4-db4a-4bc2-b092-07747ee790e6

Timeline

Publicly Published
2026-09-16 (about 2 days ago)
Added
2026-09-16 (about 1 day ago)
Last Updated
2026-09-16 (about 1 day ago)

Other

Published
Title
Published
2026-05-19
Title
Oliver POS < 4.5.4 - Unauthenticated Authorization Bypass Through User-Controlled Key to 'OliverAuth' Header
Published
2026-05-01
Title
App Builder < 5.7.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Avatar Modification via 'user_id' Parameter
Published
2025-09-22
Title
Academy LMS < 3.3.5 - Authenticated (Academy Instructor+) Insecure Direct Object Reference
Published
2026-02-04
Title
ProfileGrid < 5.9.7.3 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Profile and Cover Image Modification
Published
2026-07-02
Title
MotoPress Appointment Booking < 2.4.5 - Unauthenticated Insecure Direct Object Reference to 'payment_details.booking_id' Parameter