CVE-2026-81200: CWE-639 Authorization Bypass Through User-Controlled Key in MasterStudy LMS WordPress Plugin

CVE-2026-81200 is an authorization bypass vulnerability (CWE-639) in the MasterStudy LMS WordPress Plugin prior to version 3.7.42. The plugin fails to properly restrict access to order information, allowing any user assigned the instructor role to enumerate order IDs and read billing details of other users. This exposure includes personally identifiable information such as names, email addresses, phone numbers, and postal addresses. The vulnerability has a CVSS 3.1 base score of 2.7, indicating low severity, with network attack vector, low attack complexity, and requiring high privileges (instructor role). There is no indication of integrity or availability impact.

The vulnerability allows unauthorized disclosure of personally identifiable information related to user orders to any user with the instructor role. This could lead to privacy violations and potential misuse of exposed data. However, the impact is limited by the requirement that the attacker must have the instructor role, which implies some level of trust and privilege within the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch information is provided, users should monitor the vendor's announcements for updates. Until a patch is available, consider restricting instructor role assignments and limiting access to order information where possible.