CVE-2026-81199: CWE-200 Information Exposure in MasterStudy LMS WordPress Plugin

The MasterStudy LMS WordPress Plugin prior to version 3.7.46 contains an authorization bypass vulnerability (CWE-200) where unauthenticated users can retrieve sensitive learning statistics of any registered user. This occurs because the plugin does not verify the requester's permissions before disclosing data such as course counts, points, certificates, and quiz and assignment totals. The vulnerability has a CVSS 3.1 base score of 5.3, reflecting a network attack vector with no privileges required and no user interaction needed, resulting in limited confidentiality impact without affecting integrity or availability.

An attacker can obtain private learning statistics of any registered user without authentication. This information disclosure could lead to privacy violations but does not affect system integrity or availability. There are no known exploits in the wild at this time.

No official patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the affected plugin's endpoints or monitoring for suspicious access patterns related to user statistics.