Executive brief
The MasterStudy LMS WordPress plugin fails to properly restrict access to customer order information. An instructor-level user can view any customer's billing details—including name, email, phone, and address—by simply guessing order IDs through the plugin's AJAX endpoint. This exposes sensitive personally identifiable information of all customers using the platform.
Technical details
The vulnerability is an Insecure Direct Object Reference (IDOR) in the stm_lms_get_order_info AJAX action. The plugin checks for a valid nonce and session cookie but does not verify that the requesting instructor user owns or has permission to access the queried order. An authenticated instructor can iterate numeric order IDs and retrieve complete order records containing billing name, email, phone, address, city, postal code, and country. The attack requires a valid WordPress session and the nonce value (which is publicly embedded in page HTML for all logged-in users). The vulnerability was patched in version 3.7.42.
Affected products
- MasterStudy MasterStudy LMS before 3.7.42
Timeline
- 2026-08-27: disclosed
- 2026-08-29: patched: Fixed in version 3.7.42