Vulnerability · Published Sep 2, 2026 · Assigned by WPScan
CVE-2026-81199MasterStudy LMS < 3.7.46 - Unauthenticated Student Statistics Disclosure via student/stats REST Route
Medium 5.3
In plain English
A medium-severity information exposure in MasterStudy LMS WordPress Plugin from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.5%top 58.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Nuclei
Official description
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning a student's learning statistics, allowing unauthenticated attackers to disclose the course counts, points, certificates, quiz and assignment totals of any registered user.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | MasterStudy LMS WordPress Plugin | 0 – before 3.7.46 |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- https://wpscan.com/vulnerability/8dd53f85-5d1b-4e0b-a0f5-8c65d89cefb5/ exploit, vdb-entry, technical-description