CVE-2026-81026

MediumCVSS 4.8/10Last modified Aug 31, 2026

Description

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.40 does not verify the amount, receiver, currency or status of a payment notification before marking the corresponding order completed, allowing unauthenticated users to complete full-price orders and gain access to paid content by paying only a token amount.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Aug 29, 2026
Last modified: Aug 31, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-810278.5one-api gates one of its two channel-pinning paths and not the other. middleware/auth.go permits a request to name a specific channel either CVE-2026-810284.9ZLMediaKit confines the downloadFile API to a configured set of root directories with a prefix comparison that does not account for director CVE-2026-810298.1OpenMetadata accepts a caller-supplied post-authentication redirect target and appends the issued token to it. SamlLoginServlet reads the ca CVE-2026-810306.5Mage AI does not confine the paths accepted by its browser-items API to the project directory. BrowserItemResource in mage_ai/api/resources/CVE-2026-810317.2IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in b CVE-2026-810329.8NebulaGraph exposes its runtime configuration over an unauthenticated HTTP service. Each daemon starts the web service defined in src/webser CVE-2026-810335.3Automatisch reveals whether an address is registered through the response to its forgot-password request. The controller at packages/backend CVE-2026-810346.5Netmaker disables certificate verification on the connection to the configured mail server. The sender in pro/email/smtp.go assigns a TLS co CVE-2026-810358.1Midday allows any member of a team to delete it. The delete procedure in apps/api/src/trpc/routers/team.ts authorises the caller with the te CVE-2026-810368.1Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in its default configuration. The validati CVE-2026-810469.4Dell ThinOS 10, versions prior to 2605_10.2616, contain a Protection Mechanism Failure vulnerability. An unauthenticated attacker with remot CVE-2026-810488.8Dell ThinOS 10, versions prior to 2605_10.2616, contain an Improper Neutralization of Special Elements used in a Command ('Command Injection