WordPress Plugin Vulnerabilities

MasterStudy LMS < 3.7.42 - Instructor+ Cross-Tenant Order Billing PII Disclosure via IDOR

Description

The plugin does not correctly restrict access to order information, allowing any user with the instructor role to read other users' order billing details, including name, email address, phone number and postal address, by enumerating order IDs.

Proof of Concept

Affects Plugins

Plugin icon
masterstudy-lms-learning-management-system
Fixed in 3.7.42

References

CVE
CVE-2026-81200

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
2.7 (low)

Miscellaneous

Original Researcher
Revanth Hari Narayana Matte
Submitter
Revanth Hari Narayana Matte
Verified
Yes
WPVDB ID
1a4db76f-7043-4f9e-a584-17151d008ab1

Timeline

Publicly Published
2026-08-27 (about 2 days ago)
Added
2026-08-27 (about 1 day ago)
Last Updated
2026-08-27 (about 1 day ago)

Other

Published
Title
Published
2026-08-17
Title
KiviCare < 4.5.4 - Patient+ Cross-Patient Appointment Modification via IDOR
Published
2025-02-14
Title
RTMKit < 1.6.8 - Authenticated (Contributor+) Insecure Direct Object Reference
Published
2026-03-10
Title
Happy Addons for Elementor < 3.21.1 - Insecure Direct Object Reference to Authenticated (Contributor+) Post Duplication via 'post_id' Parameter
Published
2023-04-10
Title
Ruby Help Desk < 1.3.4 - Subscriber+ Ticket Update via IDOR
Published
2026-05-04
Title
GenerateBlocks < 2.2.1 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via Dynamic Tag Replacements