CVE case study
CVE-2026-81195: Unauthenticated Student-Enrollment Disclosure in MasterStudy LMS
MasterStudy LMS before 3.7.46 exposed a student-courses REST route that returned per-student enrollment and progress data with no authorization check, letting an unauthenticated attacker disclose the enrolled courses and learning progress of any registered user. Version 3.7.46 adds the authorization check.
- Weakness
- CWE-200
- Affected
- MasterStudy LMS before 3.7.46
- Remediation state
- Upgrade to MasterStudy LMS 3.7.46 or later
- Advisory published
- 2 Sep 2026
Why it matters
MasterStudy LMS is a popular WordPress learning-management plugin. In versions before 3.7.46, a student-courses REST route returned per-student enrollment and progress data but ran no authorization check first, so any caller, including an unauthenticated one, could request another registered user's records.
The public record scores the issue Medium at 5.3. It needs no account and leaks who is enrolled in which courses and how far along they are, which is sensitive personal and behavioral data on a platform that can hold large student rosters. Version 3.7.46 adds the missing authorization check; WPScan is holding the detailed proof of concept for a coordinated disclosure window so sites can update first.