CVE-2026-81196: MasterStudy LMS < 3.7.46 - Instructor+ Quiz Answer Disclosure via IDOR

Q: Who can exploit this issue?

A user with instructor access can exploit it. The issue exposes quiz questions belonging to other instructors, including correct answers and explanations.

Q: What access or conditions are required for exploitation?

The attacker needs an instructor-level account and quiz question identifiers belonging to another instructor. The vulnerability is caused by missing ownership verification for those identifiers.

Q: Which installations are affected?

MasterStudy LMS versions before 3.7.46 are affected. The available information does not state whether any particular WordPress or plugin configuration changes the exposure.

Published Sep 2, 2026

Updated

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of quiz question identifiers, allowing users with instructor access to read other instructors' quiz questions, including the correct answers and explanations.

Affected Software

1 affected component

WordPress MasterStudy LMS WordPress Plugin<3.7.46

Event History

Sep 2, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

A user with instructor access can exploit it. The issue exposes quiz questions belonging to other instructors, including correct answers and explanations.

What access or conditions are required for exploitation?

The attacker needs an instructor-level account and quiz question identifiers belonging to another instructor. The vulnerability is caused by missing ownership verification for those identifiers.

Which installations are affected?

MasterStudy LMS versions before 3.7.46 are affected. The available information does not state whether any particular WordPress or plugin configuration changes the exposure.