CVE-2026-81194: CWE-639 Authorization Bypass Through User-Controlled Key in MasterStudy LMS WordPress Plugin

The MasterStudy LMS WordPress Plugin prior to version 3.7.46 contains an authorization bypass vulnerability (CWE-639) that permits authenticated users with low privileges to access order line-item data of other instructors. The flaw is due to insufficient verification of user authorization when fetching sales records, enabling users to supply arbitrary user identifiers and read data not intended for them. This vulnerability does not affect availability or integrity, only confidentiality of limited data.

An attacker with any authenticated user account, including Subscriber-level access, can read other instructors' course sales records. This leads to unauthorized disclosure of potentially sensitive sales data. There is no indication of impact on data integrity or system availability. The confidentiality impact is limited but may expose business-sensitive information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles and permissions to trusted users only and monitor for suspicious access patterns related to order data retrieval. Avoid exposing user identifiers that could be manipulated to access unauthorized data.