CVE-2026-81199 MasterStudy CVE debrief

Who should care

Defenders of WordPress installations with MasterStudy LMS Plugin versions prior to 3.7.46 should assess exposure and verify remediation to prevent unauthorized disclosure of student learning statistics.

Why it matters

CVE-2026-81199 allows unauthenticated disclosure of student learning statistics in MasterStudy LMS WordPress Plugin versions prior to 3.7.46. Defenders should assess exposure, verify remediation, and monitor for unauthorized access to prevent potential data leaks.

• Verify inventory of WordPress installations with MasterStudy LMS Plugin
• Assess exposure of student learning statistics to unauthorized access
• Monitor for unauthorized access to student learning statistics
• Prioritize remediation of MasterStudy LMS WordPress Plugin versions prior to 3.7.46

Technical summary

The MasterStudy LMS WordPress Plugin before 3.7.46 does not perform an authorization check before returning a student's learning statistics, allowing unauthenticated attackers to disclose the course counts, points, certificates, quiz and assignment totals of any registered user. This vulnerability is a result of inadequate access controls in the plugin, which could lead to unauthorized data disclosure. Defenders should assess exposure and verify remediation for MasterStudy LMS WordPress Plugin versions prior to 3.7.46.

Defensive priority

Assess exposure, verify remediation for MasterStudy LMS WordPress Plugin versions prior to 3.7.46

Recommended defensive actions

• Assess exposure of MasterStudy LMS WordPress Plugin versions prior to 3.7.46
• Verify remediation for MasterStudy LMS WordPress Plugin version 3.7.46 or later
• Monitor for unauthorized access to student learning statistics
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

CVE-2026-81199 MasterStudy LMS WordPress Plugin vulnerability allows unauthenticated disclosure of student learning statistics. Official CVE Program record and NIST NVD detail page provide vulnerability metadata.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.