Description

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of a curriculum object before acting on it, allowing authenticated users with the instructor role to delete or modify curriculum sections and materials belonging to courses owned by other instructors.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.8",
  "pubDate": "2026-09-02T06:17:18.967Z",
  "pubdate": "2026-09-02T06:17:18.967Z",
  "executiveSummary": "The MasterStudy LMS WordPress plugin is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability resulting from insufficient authorization checks.\nThe vulnerability resides in the curriculum management functionality, which fails to validate the ownership of course objects during modification or deletion requests.\nThis flaw allows authenticated users assigned the 'instructor' role to manipulate curriculum sections and materials associated with courses belonging to other instructors.\nThe impact includes unauthorized data modification, loss of course integrity, and potential disruption of educational content.\nSuccessful exploitation requires the attacker to possess an active instructor-level account on the WordPress instance.\nThe vulnerability affects all versions of the MasterStudy LMS plugin prior to 3.7.46.\nThe risk is significant within multi-instructor environments where unauthorized access to proprietary course materials could lead to data tampering and loss of platform trust.",
  "technicalDetails": "The root cause of the vulnerability is an Insecure Direct Object Reference (IDOR) located within the curriculum management logic of the MasterStudy LMS plugin. The application fails to implement mandatory server-side access control checks to verify whether the currently authenticated user possesses the appropriate permissions for a specific course ID.\nWhen a curriculum section or material is being modified or deleted, the plugin performs the requested action based solely on the provided object ID without verifying that the instructor ID tied to that object matches the ID of the logged-in user.\nThe attack flow begins with the authenticated instructor identifying a valid Curriculum or Course ID belonging to a different instructor via predictable resource numbering or administrative API endpoints.\nThe attacker then crafts a malicious request—typically a POST or GET request directed at the internal curriculum manipulation functions—targeting the unauthorized object ID. Because the application logic relies on user-supplied input to identify the scope of the request, it executes the deletion or update operation under the context of the current session.\nThis behavior bypasses the expected authorization layer that should restrict an instructor's interaction strictly to the courses they personally own or manage.\nVulnerable components include the internal functions responsible for managing course structures, specifically those handling AJAX calls or direct controller actions for curriculum modifications. The vulnerability is present in versions prior to 3.7.46.\nPost-exploitation, an attacker can systematically delete curriculum modules, modify learning materials, or alter course structures belonging to other instructors, resulting in total denial of availability for the victim's course or the injection of unauthorized content. Given the nature of the application, this vulnerability is exploitable via any network interface reachable by an authenticated instructor, requiring no complex administrative privileges beyond the basic instructor role."
}