CVE-2026-81197: MasterStudy LMS < 3.7.46 - Unauthenticated Unpublished Course Title Disclosure via course-list REST Route
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not restrict access to a REST route that lists an author's courses, nor does it filter that listing by publication status, allowing unauthenticated users to read the titles and IDs of unpublished (draft, pending and private) courses.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MasterStudy LMS WordPress Pluginto a version that resolves this vulnerability.Fixed in 3.7.46
Event History
Frequently Asked Questions
Who can exploit this issue and what information can they obtain?
Any unauthenticated user can access the affected REST route. They can disclose titles and IDs for an author's unpublished courses, including draft, pending, and private courses.
Which installations are affected?
MasterStudy LMS WordPress Plugin versions before 3.7.46 are affected. The issue is exposed because the course-list REST route lacks access restrictions and does not filter results by publication status.
How can I determine whether unpublished course data may be exposed?
Review the installed MasterStudy LMS plugin version and treat versions earlier than 3.7.46 as affected. Also assess whether unpublished course titles or IDs contain sensitive information, since those fields can be read without authentication.