Executive brief
MasterStudy LMS is a WordPress learning management system plugin used to create and manage online courses. The plugin fails to properly verify user permissions when handling order updates through its REST API, allowing Instructor-role users to modify any order on the site—including free enrollment grants, revocation of paid enrollments, and tampering with order records. This undermines course access controls and revenue integrity.
Technical details
The vulnerability is an Insecure Direct Object Reference (IDOR) / broken access control flaw in the plugin's REST API order-update endpoint. The affected component does not perform per-object ownership or capability checks, allowing any authenticated Instructor-role user to modify orders belonging to other users or customers. No special preconditions beyond Instructor privileges are required; the attack is purely authorization-based. An attacker with Instructor role can grant free course enrollment, revoke paid enrollments for legitimate customers, and tamper with order notes. The vulnerability has been patched in version 3.7.50.
Affected products
- MasterStudy LMS before 3.7.50
Timeline
- 2026-09-16: disclosed
- 2026-09-30: patched: Version 3.7.50 available