What is GHSA-332v-j356-q3mj?

GHSA-332v-j356-q3mj is a security advisory published by GitHub Security Advisories with Low severity. The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object...

Which CVE IDs does GHSA-332v-j356-q3mj cover?

GHSA-332v-j356-q3mj covers the following CVE IDs: CVE-2026-81340. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-332v-j356-q3mj?

GHSA-332v-j356-q3mj has a CVSS v3 base score of 3.8, published by GitHub Security Advisories.

GHSA-332v-j356-q3mjLowCVSS 3.8

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object...

Vendor

GitHub Security Advisories

Published

September 18, 2026

Last Modified

September 18, 2026

🔗 CVE IDs covered (1)

CVE-2026-81340 →

📋 Description

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free course enrolment, revoking other users' paid enrolments, and tampering with order notes.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-81340
https://wpscan.com/vulnerability/8006876f-27bb-483d-b4e4-9fa4414d16f0
https://github.com/advisories/GHSA-332v-j356-q3mj