Is CVE-2026-81194 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-81194 being exploited in the wild.

How severe is CVE-2026-81194?

Medium severity, with a CVSS score of 4.3, published 2 September 2026.

Which products and versions are affected?

MasterStudy MasterStudy LMS before 3.7.46.

Is there a fix for CVE-2026-81194?

A patch was published on 2026-09-02: Fixed in version 3.7.46 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-81194 attacked?

It is attacked over the network.

Am I affected by CVE-2026-81194?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-81194: MasterStudy LMS authorization bypass in order retrieval

CVE-2026-81194 · Severity: medium · CVSS 4.3 · Published 2026-09-02

MasterStudy LMS is a learning management system plugin for WordPress used to deliver online courses and manage course sales. The plugin fails to properly check user permissions when retrieving order and sales data, allowing any logged-in student (even free accounts) to view other instructors' course sales records, order totals, and payment details by manipulating a user ID parameter. This exposes sensitive business and transaction information.

Quick answers

Is CVE-2026-81194 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-81194 being exploited in the wild.
How severe is CVE-2026-81194?: Medium severity, with a CVSS score of 4.3, published 2 September 2026.
Which products and versions are affected?: MasterStudy MasterStudy LMS before 3.7.46.
Is there a fix for CVE-2026-81194?: A patch was published on 2026-09-02: Fixed in version 3.7.46 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-81194 attacked?: It is attacked over the network.
Am I affected by CVE-2026-81194?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an Insecure Direct Object Reference (IDOR) / authorization bypass in the REST API endpoint /wp-json/lms/stm-lms/order/items. The plugin does not verify that the authenticated user has permission to access order data for the author_id parameter supplied in the request. An authenticated subscriber-level user can call this endpoint with another instructor's user ID and retrieve that instructor's complete order history, including course names, sale prices, order totals, status, and payment method. The vulnerability requires authentication and a valid WordPress REST nonce but can be exploited by any authenticated user regardless of role. This was fixed in version 3.7.46.

Affected products

MasterStudy MasterStudy LMS before 3.7.46

Timeline

2026-08-31: disclosed
2026-09-02: patched: Fixed in version 3.7.46

References

https://wpscan.com/vulnerability/727903d4-ce0f-4ab4-bbd4-c973091e0b8f/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.