What’s Vulnerable › Vulnerabilities
CVE-2026-81197: MasterStudy LMS < 3.7.46 - Unauthenticated Unpublished Course Title Disclosure via course-list REST Route
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-02 · updated 2026-09-03
- Weakness: CWE-200
Description
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not restrict access to a REST route that lists an author's courses, nor does it filter that listing by publication status, allowing unauthenticated users to read the titles and IDs of unpublished (draft, pending and private) courses.
Affected products
- MasterStudy LMS WordPress Plugin: before 3.7.46 — fixed in 3.7.46
How to fix
Upgrade to a fixed version: MasterStudy LMS WordPress Plugin 3.7.46. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-81197 or the next vulnerability affects your stack