CVE-2026-81194: MasterStudy LMS < 3.7.46 - Subscriber+ Cross-Instructor Order Data Disclosure via author_id Parameter
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify authorization when retrieving order line-item data, allowing any authenticated user including Subscribers to read other instructors' course sales records by supplying another user's identifier.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user can exploit it, including users with the Subscriber role. The affected endpoint exposes sales records belonging to other instructors when the requester supplies another user's identifier.
What information may be exposed?
The issue exposes order line-item data for other instructors' course sales records. The provided information does not specify every field contained in those records.
Is an unauthenticated attacker able to exploit it?
No. Exploitation requires authentication, but the required privilege level can be as low as Subscriber.
Which versions are affected?
MasterStudy LMS WordPress Plugin versions before 3.7.46 are affected. Version 3.7.46 is identified as the version at which the authorization issue is addressed.