Description

The MasterStudy LMS WordPress plugin from 1.9 before 3.7.50 does not verify that a course a member asks to enrol in is covered by their membership plan, nor that the plan identifier submitted with the request is one they actually hold, allowing any member to enrol themselves into restricted paid courses outside their plan and beyond the number of courses it entitles them to.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.2",
  "pubDate": "2026-09-25T09:17:06.323Z",
  "pubdate": "2026-09-25T09:17:06.323Z",
  "executiveSummary": "The MasterStudy LMS WordPress plugin is susceptible to an Insecure Direct Object Reference (IDOR) and broken access control vulnerability. This flaw allows authenticated members to bypass membership-based enrollment restrictions, enabling unauthorized access to paid or restricted courses.\nThe vulnerability exists due to a failure in the server-side validation process, which does not verify the correspondence between a user's held membership plan and the course requested for enrollment. By manipulating the plan identifier during the request, an attacker can circumvent entitlement checks.\nThe impact is significant, as it permits unauthorized access to premium content, potentially leading to revenue loss for site operators and the subversion of monetization strategies. The vulnerability affects MasterStudy LMS versions 1.9 through 3.7.49. No specific administrative privileges are required for exploitation, as any registered member can leverage the flaw. The attack is performed via standard HTTP requests and does not require complex infrastructure, making it highly accessible to malicious actors.\nOrganizations using the affected software are at high risk of intellectual property theft and service abuse. Immediate remediation through version updates is necessary to enforce proper access control mechanisms and ensure that enrollment requests are validated against the user's actual subscription entitlements.",
  "technicalDetails": "The vulnerability stems from improper input validation and insufficient server-side authorization checks within the enrollment handler of the MasterStudy LMS plugin. Specifically, the plugin fails to perform a cross-reference between the membership identifier submitted in the request and the actual membership status associated with the currently authenticated user's session.\nIn the vulnerable versions, the enrollment function relies on user-supplied parameters to process course registration. When a user triggers an enrollment action, the plugin accepts a membership plan identifier provided by the client. Because the back-end application does not validate whether this identifier belongs to the user or if it grants legitimate access to the specific course requested, an attacker can inject arbitrary plan IDs.\nThe attack flow proceeds as follows: First, the attacker identifies the endpoint responsible for course enrollment. Second, the attacker initiates an enrollment request while intercepting the traffic. Third, the attacker modifies the payload to include the identifier of a 'paid' or 'restricted' membership plan, regardless of whether the attacker possesses that subscription. Finally, the server processes the request, fails to verify the user's entitlement, and grants the user enrollment into the restricted course.\nThis flaw effectively bypasses business logic that should prevent enrollment in courses not covered by the user's plan. Furthermore, the system fails to enforce constraints on the total number of courses a member is entitled to enroll in, allowing users to exceed their plan's limits. This indicates a systemic failure in the access control layer where the trust is erroneously placed in the client-side input rather than verifying state through the database or session-stored user metadata.\nThe vulnerable component resides within the LMS enrollment module, affecting versions 1.9 through 3.7.49. Exploitation requires an authenticated account, but no additional administrative or elevated privileges are required, facilitating easy abuse by any registered student or member. There are no specialized network requirements, as the attack is executed through the standard application web interface over HTTP/HTTPS. Post-exploitation, the user gains unrestricted access to premium materials, effectively bypassing the payment gateway and subscription verification systems, resulting in a full compromise of the intended course access model."
}