MasterStudy LMS WordPress Plugin: Unauthorized disclosure of course student details
An authenticated Instructor can access names and email addresses of students on courses they do not own. The issue begins in version 3.6.2. The export does not identify the endpoint or course identifier field. Affected versions reported by the CNA: 3.6.2 to < 3.7.50. The export identifies 3.7.50 as fixed.
- Component
- MasterStudy LMS WordPress Plugin
- Plugin slug
masterstudy-lms-learning-management-system- Affected
- 3.6.2 to < 3.7.50
- Safe version
3.7.50- Published
- Sep 18, 2026
This CVE was published Sep 18, 2026 and is one of 31 known issues for this plugin.
Update, patch or deactivate.
The authoritative export identifies 3.7.50 as fixed. Update to that release or a later supported version. Verify the instructor's ownership or explicit management permission for the requested course before returning its student roster.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that the requesting user owns the course before returning its enrolled-student data, allowing users with the MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50's Instructor role to disclose the names and email addresses of students enrolled in other instructors' courses.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N