CVE-2026-81026

MediumCVSS 4.8/10Last modified Aug 31, 2026

Description

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.40 does not verify the amount, receiver, currency or status of a payment notification before marking the corresponding order completed, allowing unauthenticated users to complete full-price orders and gain access to paid content by paying only a token amount.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
Unknown	MasterStudy LMS WordPress Plugin	< 3.7.40

References

https://wpscan.com/vulnerability/6677b55c-5d51-4849-ac67-849a500aefe2/

Timeline

Published: Aug 29, 2026
Last modified: Aug 31, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-810278.5one-api gates one of its two channel-pinning paths and not the other. middleware/auth.go permits a request to name a specific channel either CVE-2026-810284.9ZLMediaKit confines the downloadFile API to a configured set of root directories with a prefix comparison that does not account for director CVE-2026-810298.1OpenMetadata accepts a caller-supplied post-authentication redirect target and appends the issued token to it. SamlLoginServlet reads the ca CVE-2026-810306.5Mage AI does not confine the paths accepted by its browser-items API to the project directory. BrowserItemResource in mage_ai/api/resources/CVE-2026-810317.2IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in b CVE-2026-810329.8NebulaGraph exposes its runtime configuration over an unauthenticated HTTP service. Each daemon starts the web service defined in src/webser CVE-2026-810335.3Automatisch reveals whether an address is registered through the response to its forgot-password request. The controller at packages/backend CVE-2026-810346.5Netmaker disables certificate verification on the connection to the configured mail server. The sender in pro/email/smtp.go assigns a TLS co CVE-2026-810358.1Midday allows any member of a team to delete it. The delete procedure in apps/api/src/trpc/routers/team.ts authorises the caller with the te CVE-2026-810368.1Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in its default configuration. The validati CVE-2026-810387.1The Object Transfer Service server builds its Object Action Control Point (OACP) response indication in oacp_ind_send() (subsys/bluetooth/se CVE-2026-810394.3The Bluetooth host pre-allocates a bt_conn object (a "reservation") from the fixed acl_conns[] pool for every connectable advertising set it