CVE-2026-81340: MasterStudy LMS < 3.7.50 - Instructor+ Order Status Manipulation via IDOR
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free course enrolment, revoking other users' paid enrolments, and tampering with order notes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: MasterStudy LMSto a version that resolves this vulnerability.Fixed in 3.7.50
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with the Instructor role can exploit the affected REST API to modify orders belonging to any user on the site.
Are default deployments affected?
Any deployment using a MasterStudy LMS WordPress Plugin version before 3.7.50 is affected if users can hold the Instructor role. The issue does not require a special configuration beyond access to the vulnerable order-update API.
What could an attacker do with unauthorized order updates?
An attacker could grant free course enrolment, revoke paid enrolments belonging to other users, and alter order notes.
How can I determine whether my site may be affected?
Check whether the installed MasterStudy LMS WordPress Plugin version is earlier than 3.7.50 and whether Instructor-role accounts exist. Review order changes, enrolment grants or revocations, and order-note modifications performed by Instructor accounts.
What can be done before patching?
Restrict the Instructor role to fully trusted users and remove it from accounts that do not require it. Monitor and review order and enrolment changes made by Instructor accounts until the plugin can be updated to 3.7.50 or later.