CVE-2026-81198: MasterStudy LMS privilege escalation via IDOR in curriculum

CVE-2026-81198 · Severity: low · CVSS 3.8 · Published 2026-09-02

MasterStudy LMS is a WordPress plugin providing course management and curriculum functionality for online learning platforms. The plugin fails to properly verify that an instructor owns a curriculum before allowing modifications, permitting authenticated instructors to delete, modify, or inject content into courses belonging to other instructors. This can result in loss of course materials, unauthorized course tampering, and disruption of legitimate instructor workflows.

Quick answers

Is CVE-2026-81198 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-81198 being exploited in the wild.
How severe is CVE-2026-81198?
Low severity, with a CVSS score of 3.8, published 2 September 2026.
Which products and versions are affected?
MasterStudy LMS before 3.7.46.
Is there a fix for CVE-2026-81198?
A patch was published on 2026-09-02: Fixed in version 3.7.46 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-81198 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-81198?
Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is an Insecure Direct Object Reference (IDOR) / broken access control vulnerability in the MasterStudy LMS WordPress plugin. The REST API endpoints for curriculum operations (PUT /wp-json/masterstudy-lms/v2/courses/{course_id}/curriculum/*, DELETE for sections and materials) perform only superficial ownership validation—checking the course_id in the URL path but not verifying that the authenticated user actually owns the target curriculum objects (sections and materials). An attacker with the instructor role can construct requests using their own course_id in the path while specifying victim curriculum object IDs (section_id, material_id) in the request body or as path parameters, bypassing the guards. This allows deletion of victim curriculum sections and materials, modification of section titles/ordering, and injection of attacker-controlled materials into victim sections. The vulnerability requires authentication (instructor role) and network access to the REST API, but no special preconditions. Fixed in version 3.7.46.

Affected products

  • MasterStudy LMS before 3.7.46

Timeline

  • 2026-08-31: disclosed
  • 2026-09-02: patched: Fixed in version 3.7.46

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.