Vulnerabilities / MasterStudy LMS WordPress Plugin – for Online Courses and Education / WPSEC-2026-1836
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.55 - Authenticated (Subscriber+) Missing Authorization to Paid Lesson Content Disclosure
Medium 4.3
CWE-698Fixed in 3.7.56
- ID
- WPSEC-2026-1836
- Plugin
- MasterStudy LMS WordPress Plugin – for Online Courses and Education (masterstudy-lms-learning-management-system)
- Affected
- all versions before 3.7.56
- Remediation
- Update to 3.7.56 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-698
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-28
- Attack surface
- MasterStudy LMS WordPress Plugin – for Online Courses and Education on WPSec AttackSurface
- Fix released
- Published
Description
The MasterStudy LMS WordPress Plugin plugin for WordPress is vulnerable to unauthorized access of paid lesson content in all versions up to, and including, 3.7.55. This is due to the course item access check issuing only a JavaScript redirect without stopping execution, so the lesson content was still rendered in the response, and the course player not verifying that the requested lesson belongs to the course. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view the content of paid lessons without purchasing the course.
References
- https://wpsec.com/vuln/WPSEC-2026-1836/
- https://plugins.svn.wordpress.org/masterstudy-lms-learning-management-system/tags/3.7.56/
- https://wordpress.org/plugins/masterstudy-lms-learning-management-system/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS