Executive brief
MasterStudy LMS is a WordPress plugin that enables instructors to manage online courses and track student enrollment. A flaw in versions before 3.7.50 allows any instructor to view the names and email addresses of students enrolled in other instructors' courses by exploiting missing access controls. This exposes sensitive student information and violates privacy expectations.
Technical details
The vulnerability is an insecure direct object reference (IDOR) in the course enrollment data endpoint. The plugin fails to verify that the requesting instructor owns a course before returning enrolled-student information, allowing an authenticated instructor to enumerate and retrieve student PII from courses they do not manage. The attack requires an active instructor account but no additional user interaction; the attacker can directly request student data for any course ID. The vulnerability is fixed in version 3.7.50 and later.
Affected products
- MasterStudy LMS 3.6.2 to before 3.7.50
Timeline
- 2026-09-16: disclosed
- 2026-09-18: patched: fixed in version 3.7.50