CVE-2026-81196: CWE-639 Authorization Bypass Through User-Controlled Key in MasterStudy LMS WordPress Plugin

The MasterStudy LMS WordPress Plugin prior to version 3.7.46 does not properly verify whether an instructor owns the quiz question identifiers they attempt to access. This authorization bypass (CWE-639) enables an instructor-level user to read quiz questions created by other instructors, exposing correct answers and explanations that should be restricted. The vulnerability has a low CVSS score of 2.7, reflecting limited confidentiality impact and requiring instructor privileges to exploit. There is no information about an official patch or remediation at this time.

An attacker with instructor-level privileges can access quiz questions and their correct answers and explanations that belong to other instructors. This could lead to unauthorized disclosure of quiz content, potentially undermining the integrity of assessments. There is no indication of impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict instructor access to trusted users only and monitor for unauthorized access attempts. Avoid sharing sensitive quiz content with instructors who do not require it.