# CVE-2026-81340: MasterStudy LMS privilege escalation via REST API IDOR

Source: https://junglewise.ai/threats/cve-2026-81340-masterstudy-lms-privilege-escalation-via-rest-api-idor  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-18. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-81340 · Severity: low · CVSS 3.8 · Published 2026-09-18

MasterStudy LMS is a WordPress learning management system plugin used to create and manage online courses. The plugin fails to properly verify user permissions when handling order updates through its REST API, allowing Instructor-role users to modify any order on the site—including free enrollment grants, revocation of paid enrollments, and tampering with order records. This undermines course access controls and revenue integrity.

## Quick answers

**Is CVE-2026-81340 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-81340 being exploited in the wild.

**How severe is CVE-2026-81340?** Low severity, with a CVSS score of 3.8, published 18 September 2026.

**Which products and versions are affected?** MasterStudy LMS before 3.7.50.

**Is there a fix for CVE-2026-81340?** A patch was published on 2026-09-30: Version 3.7.50 available Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-81340 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-81340?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an Insecure Direct Object Reference (IDOR) / broken access control flaw in the plugin's REST API order-update endpoint. The affected component does not perform per-object ownership or capability checks, allowing any authenticated Instructor-role user to modify orders belonging to other users or customers. No special preconditions beyond Instructor privileges are required; the attack is purely authorization-based. An attacker with Instructor role can grant free course enrollment, revoke paid enrollments for legitimate customers, and tamper with order notes. The vulnerability has been patched in version 3.7.50.

## Affected products

- MasterStudy LMS before 3.7.50

## Timeline

- 2026-09-16: disclosed
- 2026-09-30: patched: Version 3.7.50 available

## References

- [https://wpscan.com/vulnerability/8006876f-27bb-483d-b4e4-9fa4414d16f0/](https://wpscan.com/vulnerability/8006876f-27bb-483d-b4e4-9fa4414d16f0/)