CVE-2026-81340

3.8 Faible

Publiée le 18/09/2026 à 08:16 · Modifiée le 18/09/2026 à 21:08 · Analyse NVD reportée · Source : contact@wpscan.com

Description

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free course enrolment, revoking other users' paid enrolments, and tampering with order notes.

Traduire en français

Produits concernés

Unknown MasterStudy LMS WordPress Plugin

Scores CVSS

Version	Score	Source	Vecteur
3.1	3.8 Faible	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L`

Faiblesses (CWE)

CWE-639

Références

https://wpscan.com/vulnerability/8006876f-27bb-483d-b4e4-9fa4414d16f0/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories