CVE-2026-81026: unknown masterstudy lms wordpress plugin Improper Access Control
Vulnerability summary
CVE-2026-81026 is a medium (CVSS 5.3) Improper Access Control vulnerability in unknown masterstudy lms wordpress plugin. EPSS estimates a 0.22% chance of exploitation in the next 30 days, higher than 12% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 3.7.40.
Timeline
- 29-08-2026PublishedVulnerability first disclosed.
- 30-08-2026Last modifiedVulnerability information updated.
Description
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.40 does not verify the amount, receiver, currency or status of a payment notification before marking the corresponding order completed, allowing unauthenticated users to complete full-price orders and gain access to paid content by paying only a token amount.
CVSS metrics
3 scores · 3 sources · 1 version- CVE.orgCNA4.8MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:NDiffers
- NVDNIST4.8MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:NDiffers
EPSS trend
Probability
0.22%
Chance of exploitation in the next 30 days
Percentile
12%
Versus all other CVEs
30-day change
+0.08 pp
From 0.14% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
- CWE-602Client-Side Enforcement of Server-Side SecurityThe product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.
Affected systems
Unknown1 product
- masterstudy lms wordpress plugin< 3.7.40
Wordpress1 product
- masterstudy-lms-learning-management-system< 3.7.40
2 vendors · 2 products