WordPress Plugin Vulnerabilities

MasterStudy LMS < 3.7.46 - Unauthenticated Student Statistics Disclosure via student/stats REST Route

Description

The plugin does not perform an authorization check before returning a student's learning statistics, allowing unauthenticated attackers to disclose the course counts, points, certificates, quiz and assignment totals of any registered user.

Proof of Concept

Affects Plugins

Plugin icon
masterstudy-lms-learning-management-system
Fixed in 3.7.46

References

CVE
CVE-2026-81199

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Revanth Hari Narayana Matte
Submitter
Revanth Hari Narayana Matte
Verified
Yes
WPVDB ID
8dd53f85-5d1b-4e0b-a0f5-8c65d89cefb5

Timeline

Publicly Published
2026-08-31 (about 2 days ago)
Added
2026-08-31 (about 1 day ago)
Last Updated
2026-08-31 (about 1 day ago)

Other

Published
Title
Published
2024-10-21
Title
News Kit Elementor Addons < 1.2.2 - Authenticated (Contributor+) Sensitive Information Exposure via Canvas Menu Elementor Template
Published
2026-01-23
Title
RegistrationMagic <= 6.0.7.2 - Subscriber+ Sensitive Data Disclosure
Published
2026-08-05
Title
YITH WooCommerce Zoom Magnifier < 2.52.1 - Unauthenticated Information Exposure
Published
2026-02-20
Title
EventPrime < 4.2.8.4 - Unauthenticated Information Exposure
Published
2025-12-22
Title
Tablesome < 1.1.35.2 - Authenticated (Subscriber+) Information Exposure