The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.42 does not correctly restrict access to order information, allowing any user with… (CVE-2026-81200)

CVE-2026-81200 describes an access control weakness in the MasterStudy LMS WordPress plugin prior to version 3.7.42. Specifically, the plugin fails to properly restrict access to order information, enabling any user assigned the instructor role to enumerate order IDs and retrieve billing details of other users. The exposed data includes personally identifiable information such as names, email addresses, phone numbers, and postal addresses. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key).

The vulnerability allows unauthorized disclosure of sensitive billing information to users with the instructor role. There is no indication of impact on data integrity or availability. The confidentiality impact is limited to the exposure of personal order details.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided, users should monitor the vendor's announcements for updates. Until a fix is available, consider restricting instructor role permissions or limiting access to order information to trusted users only.