WordPress Plugin Vulnerabilities

MasterStudy LMS < 3.7.40 - Unauthenticated Payment Bypass via PayPal IPN

Description

The plugin does not verify the amount, receiver, currency or status of a payment notification before marking the corresponding order completed, allowing unauthenticated users to complete full-price orders and gain access to paid content by paying only a token amount.

Proof of Concept

Affects Plugins

Plugin icon
masterstudy-lms-learning-management-system
Fixed in 3.7.40

References

CVE
CVE-2026-81026

Classification

Type
ACCESS CONTROLS
OWASP top 10
A5: Broken Access Control
CWE
CWE-284
CVSS
4.8 (medium)

Miscellaneous

Original Researcher
Abdullah Kareem
Submitter
Abdullah Kareem
Submitter website
https://cyberkareem.com
Submitter twitter
cyberkareem
Verified
Yes
WPVDB ID
6677b55c-5d51-4849-ac67-849a500aefe2

Timeline

Publicly Published
2026-08-27 (about 2 days ago)
Added
2026-08-27 (about 1 day ago)
Last Updated
2026-08-27 (about 1 day ago)

Other

Published
Title
Published
2024-12-10
Title
Last Viewed Posts by WPBeginner < 1.0.2 - Unauthenticated Sensitive Information Exposure
Published
2026-08-19
Title
Dokan < 5.0.14 - Shop Manager+ Arbitrary Plugin Installation/Activation via REST API
Published
2025-03-06
Title
VK Blocks < 1.95.0.3 - Missing Authorization to Sensitive Information Exposure
Published
2022-01-04
Title
Advanced Cron Manager - Subscriber+ Arbitrary Events/Schedules Creation/Deletion
Published
2024-03-18
Title
s2Member – Best Membership Plugin for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions < 240315 - Information Exposure