CVE-2026-81197
Received Received - Intake

Unauthenticated Course Title Exposure in MasterStudy LMS WordPress Plugin

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: WPScan

Description
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not restrict access to a REST route that lists an author's courses, nor does it filter that listing by publication status, allowing unauthenticated users to read the titles and IDs of unpublished (draft, pending and private) courses.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-81197
EUVD
EUVD-2026-69850

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
masterstudy lms_wordpress_plugin to 3.7.46 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the MasterStudy LMS WordPress plugin versions before 3.7.46. It allows unauthenticated users to access a REST route that lists courses by an author without proper restrictions or filtering by publication status. This exposes the titles and IDs of unpublished courses, including draft, pending, or private states.

Detection Guidance

Check if the MasterStudy LMS WordPress plugin version is below 3.7.46. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files for version details. Test access to the REST route '/wp-json/ms/v1/courses' to see if unpublished course titles and IDs are exposed without authentication.

Impact Analysis

Unauthenticated users can view unpublished course details, potentially exposing sensitive or proprietary information before it is intended for public release. This could lead to data leaks or misuse of unpublished content.

Compliance Impact

This vulnerability may violate data protection regulations like GDPR or HIPAA by exposing unpublished or sensitive course data without proper access controls, potentially leading to unauthorized data disclosure.

Mitigation Strategies

Update the MasterStudy LMS plugin to version 3.7.46 or later immediately. If updating is not possible, consider disabling the plugin temporarily until an update is applied. Review server logs for unauthorized access attempts to the REST route mentioned in the vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81197. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart