CVE-2026-88844: MasterStudy LMS 3.6.2 - < 3.7.50 - Instructor+ Student PII Disclosure via IDOR
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that the requesting user owns the course before returning its enrolled-student data, allowing users with the MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50's Instructor role to disclose the names and email addresses of students enrolled in other instructors' courses.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A user assigned the MasterStudy LMS Instructor role can exploit it. The issue allows that instructor to access enrolled-student names and email addresses for courses owned by other instructors.
Which installations are affected?
Installations running the MasterStudy LMS WordPress Plugin before version 3.7.50 are affected. The provided information does not state whether any particular default role assignments or configurations are required beyond an attacker having the Instructor role.
What access does an attacker need?
The attacker needs an authenticated account with the MasterStudy LMS Instructor role. No information is provided indicating that unauthenticated users or students can exploit the issue.