CVE-2026-81197 MasterStudy CVE debrief

Who should care

Defenders responsible for WordPress installations with the MasterStudy LMS Plugin should assess exposure and verify the version of the plugin to prevent potential unauthorized access to course information. They should also review access controls for the REST route and monitor for unauthorized access attempts to course information.

Why it matters

CVE-2026-81197 allows unauthenticated users to read unpublished course titles and IDs in the MasterStudy LMS WordPress Plugin. Defenders should verify the plugin version and restrict access to the affected REST route to prevent potential unauthorized access to course information.

• Potential unauthorized access to unpublished course information
• Need to verify plugin version and restrict access to the affected REST route
• Possible impact on course content confidentiality

Technical summary

The MasterStudy LMS WordPress Plugin before 3.7.46 does not restrict access to a REST route that lists an author's courses, nor does it filter that listing by publication status. This allows unauthenticated users to read the titles and IDs of unpublished (draft, pending and private) courses. The vulnerability impacts WordPress installations with the MasterStudy LMS Plugin, requiring defenders to assess exposure and verify the plugin version to prevent potential unauthorized access to course information. Defenders should prioritize verifying the version of the MasterStudy LMS WordPress Plugin and restricting access to the affected REST route.

Defensive priority

Defenders should prioritize verifying the version of the MasterStudy LMS WordPress Plugin and restricting access to the affected REST route.

Recommended defensive actions

• Verify the version of the MasterStudy LMS WordPress Plugin and update to 3.7.46 or later
• Restrict access to the affected REST route
• Monitor for unauthorized access to course information
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, but additional verification is needed to confirm affected versions and remediation. Defenders should verify plugin version and configuration, review access controls for the REST route, and monitor for unauthorized access attempts to course information. The vulnerability allows unauthenticated users to read unpublished course titles and IDs.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.