UNKNOWN NVD

CVE-2026-81340

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through its

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free course enrolment, revoking other users' paid enrolments, and tampering with order notes.

References

https://wpscan.com/vulnerability/8006876f-27bb-483d-b4e4-9fa4414d16f0/

Published: 2026-09-18 · Source: NVD · Feed updated: 2026-09-18

This unknown severity vulnerability was published on 2026-09-18 via NVD.

vulnfeed aggregates 14468 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.