CVE-2026-81197 MasterStudy CVE debrief

Who should care

Administrators and users of the MasterStudy LMS WordPress Plugin, especially those with unpublished courses, should be aware of this vulnerability and take appropriate defensive actions to protect their sites and data.

Technical summary

The MasterStudy LMS WordPress Plugin before 3.7.46 has a vulnerability that allows unauthenticated users to access a REST route listing an author's courses without proper access restrictions or publication status filtering. This results in the exposure of unpublished course titles and IDs (draft, pending, and private). The vulnerability has a medium severity level with a CVSS score of 5.3. To mitigate this vulnerability, it is recommended to restrict access to the vulnerable REST route through additional authentication or authorization mechanisms, monitor for potential exploitation attempts, and perform an inventory check to identify and update vulnerable instances of the MasterStudy LMS WordPress Plugin. Implementing compensating controls, such as web application firewalls, may also help detect and prevent exploitation.

Defensive priority

Medium-priority defensive actions are recommended due to the MEDIUM CVSS score of 5.3 for CVE-2026-81197, which allows unauthenticated users to access unpublished course information.

Recommended defensive actions

• Review and apply the vendor's official patch or upgrade to version 3.7.46 or later.
• Restrict access to the vulnerable REST route through additional authentication or authorization mechanisms.
• Monitor for and respond to potential exploitation attempts targeting this vulnerability.
• Perform an inventory check to identify and update vulnerable instances of the MasterStudy LMS WordPress Plugin.
• Consider implementing compensating controls, such as web application firewalls, to detect and prevent exploitation.

Evidence notes

Evidence from the NVD and WPScan indicates that the MasterStudy LMS WordPress Plugin before 3.7.46 has a vulnerability allowing unauthenticated users to read unpublished course titles and IDs. Further review is needed to determine the full scope of affected products and versions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.