# CVE-2026-81199: MasterStudy LMS information disclosure in student stats endpoint

Source: https://junglewise.ai/threats/cve-2026-81199-masterstudy-lms-information-disclosure-in-student-stats-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-81199 · Severity: medium · CVSS 5.3 · Published 2026-09-02

MasterStudy LMS is a popular WordPress learning management system plugin used to deliver online courses and track student progress. A flaw in the plugin allows unauthenticated attackers to retrieve any student's learning statistics—including course progress, points, certificates, and quiz/assignment counts—without requiring login credentials, exposing sensitive educational and performance data.

## Quick answers

**Is CVE-2026-81199 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-81199 being exploited in the wild.

**How severe is CVE-2026-81199?** Medium severity, with a CVSS score of 5.3, published 2 September 2026.

**Which products and versions are affected?** MasterStudy MasterStudy LMS before 3.7.46.

**Is there a fix for CVE-2026-81199?** A patch was published on 2026-09-02: Fixed in version 3.7.46 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-81199 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-81199?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization bypass (CWE-200: Exposure of Sensitive Information) in the REST API endpoint `/wp-json/masterstudy-lms/v2/student/stats/{user_id}`. The plugin fails to verify that the requester has permission to access another user's statistics before returning the data. An unauthenticated attacker can obtain a valid REST nonce (publicly exposed in page HTML) and use it to query any registered user's statistics. The attack requires network access to the WordPress site and knowledge of a valid user ID, but no authentication or user interaction. The vulnerability is fixed in version 3.7.46; all installations before this version are vulnerable.

## Affected products

- MasterStudy MasterStudy LMS before 3.7.46

## Timeline

- 2026-08-31: disclosed
- 2026-09-02: patched: Fixed in version 3.7.46
- 2026-09-02: advisory: CVE-2026-81199 published

## References

- [https://wpscan.com/vulnerability/8dd53f85-5d1b-4e0b-a0f5-8c65d89cefb5/](https://wpscan.com/vulnerability/8dd53f85-5d1b-4e0b-a0f5-8c65d89cefb5/)