WordPress Plugin Vulnerabilities

MasterStudy LMS < 3.7.46 - Instructor+ Cross-Course Curriculum Deletion and Tampering via IDOR

Description

The plugin does not properly verify ownership of a curriculum object before acting on it, allowing authenticated users with the instructor role to delete or modify curriculum sections and materials belonging to courses owned by other instructors.

Proof of Concept

Affects Plugins

Plugin icon
masterstudy-lms-learning-management-system
Fixed in 3.7.46

References

CVE
CVE-2026-81198

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
3.8 (low)

Miscellaneous

Original Researcher
Revanth Hari Narayana Matte
Submitter
Revanth Hari Narayana Matte
Verified
Yes
WPVDB ID
424b3a47-78fe-4c95-a317-c1deaf2b7b0c

Timeline

Publicly Published
2026-08-31 (about 2 days ago)
Added
2026-08-31 (about 1 day ago)
Last Updated
2026-08-31 (about 1 day ago)

Other

Published
Title
Published
2026-06-30
Title
Academy LMS < 3.8.1 - Subscriber+ Cross-User Lesson Note and Progress Modification via IDOR
Published
2025-11-18
Title
Eagle Booking <= 1.3.4.3 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2025-10-17
Title
Event Tickets and Registration < 5.26.6 - Unauthenticated Ticket Payment Bypass
Published
2026-04-11
Title
Frontend File Manager Plugin <= 23.6 - Subscriber+ Arbitrary Download Access via IDOR
Published
2026-07-13
Title
JS Help Desk – AI-Powered Support & Ticketing System < 3.1.5 - Subscriber+ Cross-User Support Ticket Disclosure via IDOR