CVE-2026-81026: MasterStudy LMS < 3.7.40 - Unauthenticated Payment Bypass via PayPal IPN
Published Aug 29, 2026
·Updated
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.40 does not verify the amount, receiver, currency or status of a payment notification before marking the corresponding order completed, allowing unauthenticated users to complete full-price orders and gain access to paid content by paying only a token amount.
Affected Software
1 affected component
MasterStudy MasterStudy LMS WordPress Plugin<3.7.40
Event History
Aug 29, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An unauthenticated user can exploit it. The affected payment flow can mark a full-price order as completed after a token payment, granting access to paid content.
2
What payment conditions are not validated?
The plugin does not verify the payment amount, receiver, currency, or payment status in the PayPal IPN notification before completing the order.
3
Which versions are affected?
Versions of the MasterStudy LMS WordPress Plugin before 3.7.40 are affected.