Junglewise Threat Intelligence

CVE-2026-81197: MasterStudy LMS information disclosure in REST API

CVE-2026-81197 · Severity: medium · CVSS 5.3 · Published 2026-09-02

Executive brief

MasterStudy LMS is a WordPress plugin that manages online learning courses. An unauthenticated attacker can access a public REST API endpoint to discover the titles and IDs of unpublished courses (drafts, pending, and private), which should only be visible to authorized administrators or instructors. This could expose confidential course information and assist attackers in enumerating system users.

Technical details

The plugin fails to implement authentication checks or publication status filtering on the /wp-json/lms/stm-lms-user/course-list REST endpoint. An unauthenticated attacker can make HTTP GET requests with an author_id parameter to retrieve all courses by that user, bypassing the front-end access controls that hide unpublished content. The vulnerability allows enumeration of both course metadata and user IDs across the WordPress installation. This is a sensitive data exposure flaw (CWE-200) accessible over the network without authentication. The issue is resolved in version 3.7.46.

Affected products

  • MasterStudy MasterStudy LMS before 3.7.46

Timeline

  • 2026-08-31: disclosed
  • 2026-09-02: patched: Version 3.7.46 fixes the vulnerability

References