The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.40 does not verify the amount, receiver, currency or status of a payment… (CVE-2026-81026)

CVE-2026-81026 affects the MasterStudy LMS WordPress plugin prior to version 3.7.40. The vulnerability arises because the plugin fails to verify critical payment details such as amount, receiver, currency, and payment status before marking an order as completed. This lack of verification enables unauthenticated attackers to manipulate payment notifications and gain access to paid content without paying the full price. The CVSS 3.1 base score is 4.8 (medium severity), reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and limited confidentiality and integrity impact.

An attacker can complete orders without paying the full price by exploiting the lack of payment verification, leading to unauthorized access to paid content. This results in potential revenue loss and unauthorized content distribution. The impact is limited to confidentiality and integrity, with no availability impact reported.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling the affected plugin or restricting access to payment processing features to trusted users only.