Executive brief
MasterStudy LMS is a learning management system plugin for WordPress used to create and manage online courses and quizzes. The plugin fails to properly verify that instructors own quiz questions, allowing instructors to view other instructors' quiz questions including correct answers and explanations through a simple REST API manipulation. This could compromise the integrity of courses and allow unauthorized access to answer keys.
Technical details
This is an Insecure Direct Object Reference (IDOR) vulnerability in the MasterStudy LMS plugin's REST API endpoints for quiz management. The vulnerability exists in the /wp-json/masterstudy-lms/v2/quizzes/{id}/questions endpoint, which does not validate that the authenticated instructor owns the quiz before allowing attachment and retrieval of question objects. An instructor can create their own quiz, attach a victim instructor's question ID to it via a PUT request, and then retrieve the full question details including the correct answers and explanations. The attack requires an instructor-level account but no additional user interaction. The vulnerability was fixed in version 3.7.46.
Affected products
- MasterStudy LMS before 3.7.46
Timeline
- 2026-08-31: disclosed: Publicly published on WPScan
- 2026-08-31: patched: Fixed in version 3.7.46