CVE-2026-81197: CWE-200 Information Exposure in MasterStudy LMS WordPress Plugin

The MasterStudy LMS WordPress Plugin versions prior to 3.7.46 contain a vulnerability where a REST route that lists an author's courses is accessible without authentication and does not filter courses by their publication status. As a result, an attacker can retrieve information about unpublished courses such as their titles and IDs. This is classified as CWE-200 (Information Exposure). The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact.

Unauthenticated users can access information about unpublished courses, including titles and IDs, which may reveal sensitive or confidential course content planning details. There is no impact on integrity or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the affected versions are prior to 3.7.46, upgrading to version 3.7.46 or later is likely to address the issue once confirmed by the vendor. Until an official fix is available, restrict access to the REST API routes or implement access controls to prevent unauthenticated access to unpublished course data.