WordPress Plugin Vulnerabilities

MasterStudy LMS < 3.7.50 - Instructor+ Order Status Manipulation via IDOR

Description

The plugin does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free course enrolment, revoking other users' paid enrolments, and tampering with order notes.

Proof of Concept

Affects Plugins

Plugin icon
masterstudy-lms-learning-management-system
Fixed in 3.7.50

References

CVE
CVE-2026-81340

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
3.8 (low)

Miscellaneous

Original Researcher
Shivamani Vastrala
Submitter
Shivamani Vastrala
Verified
Yes
WPVDB ID
8006876f-27bb-483d-b4e4-9fa4414d16f0

Timeline

Publicly Published
2026-09-16 (about 2 days ago)
Added
2026-09-16 (about 1 day ago)
Last Updated
2026-09-16 (about 1 day ago)

Other

Published
Title
Published
2025-04-11
Title
User Registration & Membership – Custom Registration Form, Login Form, and User Profile < 4.1.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) User Password Update
Published
2026-09-10
Title
Masteriyo LMS 1.14.0 - 3.4.0 - Instructor+ Arbitrary Post Disclosure via IDOR
Published
2026-03-14
Title
NEX-Forms – Ultimate Forms Plugin for WordPress < 9.1.10 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_set_entry_update_id
Published
2025-09-09
Title
WPGYM - Wordpress Gym Management System <= 67.7.0 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover
Published
2023-06-19
Title
EventON < 2.1.2 - Unauthenticated Post Access via IDOR