Description

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.40 does not verify the amount, receiver, currency or status of a payment notification before marking the corresponding order completed, allowing unauthenticated users to complete full-price orders and gain access to paid content by paying only a token amount.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.8",
  "pubDate": "2026-08-29T06:17:55.990Z",
  "pubdate": "2026-08-29T06:17:55.990Z",
  "executiveSummary": "The MasterStudy LMS WordPress plugin, prior to version 3.7.40, contains a critical authentication and payment validation vulnerability. The flaw resides in the handling of payment notifications, where the application fails to verify essential transaction integrity parameters, such as the total amount, currency, receiver information, and payment status. Consequently, the system erroneously marks orders as completed upon receipt of a notification, regardless of the actual financial outcome.\nThis vulnerability is categorized as an improper authorization and business logic error. The impact is severe, as it allows unauthenticated, remote attackers to gain unauthorized access to restricted, premium educational content and digital products by bypassing the financial transaction gateway. An attacker can manipulate payment notifications to trigger a 'payment success' state with a negligible or nominal token payment, effectively nullifying the requirement for full-price transaction verification. This vulnerability poses a significant risk to revenue integrity and content security, necessitating immediate patching to the latest secure version to prevent unauthorized access and potential financial loss.",
  "technicalDetails": "The vulnerability originates from a critical breakdown in the payment verification logic within the MasterStudy LMS plugin's webhook or notification handling mechanism. When a payment gateway sends a notification to the plugin regarding a transaction, the code responsible for processing this payload fails to perform server-side validation against the expected transaction state.\nSpecifically, the component responsible for listening to payment callbacks does not cross-reference the incoming data with the order's specific financial details recorded in the database. Because the application logic relies on the receipt of an HTTP request rather than a cryptographically verified and server-side authenticated confirmation of payment status from the payment provider, it assumes that the receipt of the notification equates to a successful transaction.\nThe exploitation flow proceeds as follows: An attacker initiates the standard checkout process for a premium course or resource within the MasterStudy LMS ecosystem. During the payment redirection or webhook delivery phase, the attacker intercepts the transaction notification sent to the plugin's endpoint. By crafting a malformed or spoofed notification—or by exploiting the lack of amount verification—the attacker sends a payload that mimics the structure of a legitimate payment success message, potentially specifying a nominal or zero-sum value for the transaction. The plugin's processing function, lacking conditional checks to verify that the 'amount_paid' parameter matches the 'order_total' attribute, fails to validate the receiver ID, currency, or payment status (e.g., 'Completed' vs 'Pending' or 'Failed').\nUpon processing this unverified request, the plugin updates the order status in the WordPress database to 'Completed'. This update triggers the automatic provisioning of access to the specific LMS content associated with the order ID. Since this process occurs without requiring authenticated user sessions to be associated with a valid, verified financial transaction, the attack is accessible to any remote user with network access to the notification endpoint. The post-exploitation impact allows attackers to gain full, unauthorized access to paid digital materials without fulfilling the actual financial obligation, rendering the plugin’s access control mechanism ineffective."
}