CVE-2026-81198: CWE-639 Authorization Bypass Through User-Controlled Key in MasterStudy LMS WordPress Plugin

The MasterStudy LMS WordPress Plugin versions prior to 3.7.46 do not properly verify ownership of curriculum objects before performing actions on them. This authorization bypass (CWE-639) enables authenticated instructors to delete or modify curriculum sections and materials belonging to other instructors' courses. The vulnerability has a CVSS 3.1 base score of 3.8, indicating low severity, with network attack vector, low complexity, high privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact.

An authenticated user with the instructor role can delete or modify curriculum content of courses they do not own. This can lead to unauthorized modification or deletion of course materials, potentially disrupting course delivery and affecting data integrity and availability. There is no confidentiality impact reported.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict instructor role permissions carefully and monitor for unauthorized curriculum modifications.