Executive brief
MasterStudy LMS is a WordPress plugin that provides learning management system functionality for online courses and quizzes. The plugin fails to verify that a user owns a quiz attempt before returning its results, allowing any logged-in student to view other students' quiz grades, pass/fail status, and attempt timestamps by simply guessing or iterating through attempt identifiers. This exposes sensitive academic performance data to unauthorized users.
Technical details
The vulnerability is an insecure direct object reference (IDOR) in the quiz attempt results endpoint that lacks per-object ownership validation. An authenticated user with the subscriber role can enumerate quiz attempt IDs and retrieve another user's quiz attempt data including grades, pass/fail status, and attempt timestamps. No network-level attack vector is required beyond normal authenticated access to the WordPress site; the attacker needs only valid login credentials at the subscriber level or above.
Affected products
- MasterStudy LMS WordPress Plugin before 3.7.50
Timeline
- 2026-09-23: disclosed: CVE-2026-81339 published
- 2026-09-23: patched: Fixed in version 3.7.50