CVE case study
CVE-2026-81194: Subscriber+ Cross-Instructor Order-Data IDOR in MasterStudy LMS
MasterStudy LMS before 3.7.46 did not properly verify authorization when retrieving order line-item data, so any authenticated user including a Subscriber could read another instructor's course sales records by supplying that user's identifier in the author_id parameter. Version 3.7.46 enforces the check.
- Weakness
- CWE-639
- Affected
- MasterStudy LMS before 3.7.46
- Remediation state
- Upgrade to MasterStudy LMS 3.7.46 or later
- Advisory published
- 2 Sep 2026
Why it matters
MasterStudy LMS lets instructors sell courses and view their own order data. In versions before 3.7.46, the order line-item retrieval trusted a client-supplied author_id without verifying that the caller owned that identity, an insecure direct object reference (CWE-639).
The public record scores the issue Medium at 4.3. Because any authenticated role down to Subscriber could substitute another user's identifier, a low-trust account could read other instructors' course sales records, exposing revenue and customer data across tenants on the same site. Version 3.7.46 enforces the authorization check; WPScan is holding the detailed proof of concept for a coordinated disclosure window so sites can update first.