WordPress Plugin Vulnerabilities

MasterStudy LMS < 3.7.46 - Instructor+ Quiz Answer Disclosure via IDOR

Description

The plugin does not properly verify ownership of quiz question identifiers, allowing users with instructor access to read other instructors' quiz questions, including the correct answers and explanations.

Proof of Concept

Affects Plugins

Plugin icon
masterstudy-lms-learning-management-system
Fixed in 3.7.46

References

CVE
CVE-2026-81196

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
2.7 (low)

Miscellaneous

Original Researcher
Revanth Hari Narayana Matte
Submitter
Revanth Hari Narayana Matte
Verified
Yes
WPVDB ID
d11acb84-6dd0-4229-ac30-dba3ad6b9614

Timeline

Publicly Published
2026-08-31 (about 2 days ago)
Added
2026-08-31 (about 1 day ago)
Last Updated
2026-08-31 (about 1 day ago)

Other

Published
Title
Published
2024-04-25
Title
Crelly Slider < 1.4.6 - Subscriber+ Insecure Direct Object Reference
Published
2024-12-02
Title
WPCasa < 1.3.0 - Insecure Direct Object Reference
Published
2025-12-24
Title
Membership For WooCommerce < 3.0.4 - Unauthenticated Insecure Direct Object Reference
Published
2026-06-30
Title
Qi Blocks < 1.5.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Style Modification via 'page_id' Parameter
Published
2024-08-15
Title
Custom Field For WP Job Manager < 1.3 - Insecure Direct Object Reference to Sensitive Information Exposure via Shortcode