Quick answers
- Is CVE-2026-81199 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-81199 being exploited in the wild.
- How severe is CVE-2026-81199?
- Medium severity, with a CVSS score of 5.3, published 2 September 2026.
- Which products and versions are affected?
- MasterStudy MasterStudy LMS before 3.7.46.
- Is there a fix for CVE-2026-81199?
- A patch was published on 2026-09-02: Fixed in version 3.7.46 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-81199 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-81199?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an authorization bypass (CWE-200: Exposure of Sensitive Information) in the REST API endpoint `/wp-json/masterstudy-lms/v2/student/stats/{user_id}`. The plugin fails to verify that the requester has permission to access another user's statistics before returning the data. An unauthenticated attacker can obtain a valid REST nonce (publicly exposed in page HTML) and use it to query any registered user's statistics. The attack requires network access to the WordPress site and knowledge of a valid user ID, but no authentication or user interaction. The vulnerability is fixed in version 3.7.46; all installations before this version are vulnerable.
Affected products
- MasterStudy MasterStudy LMS before 3.7.46
Timeline
- 2026-08-31: disclosed
- 2026-09-02: patched: Fixed in version 3.7.46
- 2026-09-02: advisory: CVE-2026-81199 published