Description

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify authorization when retrieving order line-item data, allowing any authenticated user including Subscribers to read other instructors' course sales records by supplying another user's identifier.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-02T06:17:18.580Z",
  "pubdate": "2026-09-02T06:17:18.580Z",
  "executiveSummary": "The MasterStudy LMS WordPress plugin is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability due to improper authorization checks.\nThis flaw resides in the order line-item data retrieval functionality, enabling authenticated users to access sensitive sales records belonging to other instructors.\nThe vulnerability affects all versions of the MasterStudy LMS plugin prior to 3.7.46.\nAny authenticated user, including those with minimal privileges such as 'Subscriber', can exploit this vulnerability without further elevated permissions.\nBy manipulating identifiers in the request parameters, an attacker can bypass access control logic to exfiltrate private financial or operational data.\nThis represents a significant privacy and security risk, as it permits unauthorized disclosure of instructor sales performance, potentially exposing proprietary business information.\nExploitation requires active authentication on the target WordPress site, but does not necessitate administrative privileges, significantly lowering the barrier for potential attackers.",
  "technicalDetails": "The vulnerability originates from a failure to implement robust server-side authorization checks within the API or backend functions responsible for processing requests for order line-item data.\nWhen a request is initiated to retrieve specific order data, the application fails to validate whether the authenticated user possesses the appropriate permissions or the ownership status of the requested resource.\nThe root cause is an insecure implementation of object-level access control. Instead of relying on a cryptographically secure token or validating the user's ID against the order owner's ID in the database, the system trusts the user-supplied identifier provided in the request parameters.\nExploitation involves an attacker crafting a request to the vulnerable endpoint, supplying a target identifier (such as an order ID or instructor ID) that does not belong to the currently authenticated session.\nBecause the backend performs no verification to ensure the requesting user is the rightful owner of the order data, the server processes the request and returns the sensitive information associated with the provided ID.\nThe attack flow follows these steps: 1) The attacker authenticates as a standard Subscriber; 2) The attacker identifies the API endpoint or AJAX action responsible for fetching order line-item data; 3) The attacker modifies the order identification parameter in the request body or URL; 4) The server-side code executes the query using the user-provided ID without checking authorization; 5) The sensitive sales records are returned to the attacker's browser.\nThis behavior facilitates unauthorized access to private data across the platform, violating the principle of least privilege. The impact of successful exploitation includes the potential for large-scale information disclosure, where an attacker could iterate through sequential IDs to harvest comprehensive sales data across the entire LMS installation.\nThe affected components include the request handlers responsible for order reporting and line-item data processing. The vulnerability is present in versions prior to 3.7.46 and exposes data over the standard network interface accessible to any authenticated WordPress user.\nPost-exploitation, an attacker gains visibility into proprietary commercial activity, which may be leveraged for competitive intelligence or further reconnaissance against the affected WordPress ecosystem."
}