CVE-2026-81339: MasterStudy LMS < 3.7.50 - Subscriber+ Quiz Attempt Grade Disclosure via IDOR
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform a per-object ownership check when returning a quiz attempt result, allowing any authenticated user with a minimal (subscriber) role to read other students' quiz grades, pass/fail status and attempt timestamps by referencing an attempt identifier belonging to another user.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user with at least the Subscriber role can exploit it. The attacker does not need to own the quiz attempt they access.
What information can be exposed?
An attacker can view other students' quiz grades, pass/fail status, and quiz-attempt timestamps.
What does an attacker need to do to access another student's results?
They need to reference an attempt identifier that belongs to another user. The affected plugin does not enforce a per-object ownership check when returning the attempt result.
Which installations are affected?
MasterStudy LMS WordPress Plugin versions before 3.7.50 are affected. Updating to version 3.7.50 or later addresses the affected version range.