Low severity · published Aug 29, 2026
CVE-2026-81200
MasterStudy LMS < 3.7.42 - Instructor+ Cross-Tenant Order Billing PII Disclosure via IDOR
2.7
CVSS
0.3%
EPSS
No
On KEV
Description
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.42 does not correctly restrict access to order information, allowing any user with the instructor role to read other users' order billing details, including name, email address, phone number and postal address, by enumerating order IDs.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ML
MasterStudy LMS WordPress Plugin ·
before 3.7.42 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-81200
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-81200
wpscan.com
https://wpscan.com/vulnerability/1a4db76f-7043-4f9e-a584-17151d008ab1/
More from MasterStudy LMS WordPress Plugin
7.2
CVE-2026-88843
MasterStudy LMS 3.5.29 - < 3.7.50 - Contributor+ LFI via Elementor Courses Categories Widget
5.3
CVE-2026-88846
MasterStudy LMS 2.3.0 - < 3.7.50 - Unauthenticated Account Creation with Registration Disabled
5.3
CVE-2026-81199
MasterStudy LMS < 3.7.46 - Unauthenticated Student Statistics Disclosure via student/stats REST Route
5.3
CVE-2026-81197
MasterStudy LMS < 3.7.46 - Unauthenticated Unpublished Course Title Disclosure via course-list REST Route
5.3
CVE-2026-81195
MasterStudy LMS < 3.7.46 - Unauthenticated Student Enrollment Disclosure via student-courses REST Route