{"id":"CVE-2026-81197","state":"PUBLISHED","title":"MasterStudy LMS < 3.7.46 - Unauthenticated Unpublished Course Title Disclosure via course-list REST Route","description":"The MasterStudy LMS WordPress Plugin  WordPress plugin before 3.7.46 does not restrict access to a REST route that lists an author's courses, nor does it filter that listing by publication status, allowing unauthenticated users to read the titles and IDs of unpublished (draft, pending and private) courses.","publishedAt":"2026-09-02T06:00:21.940Z","updatedAt":"2026-09-02T10:45:55.590Z","severity":{"score":5.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","source":"CISA-ADP"},"assigner":"WPScan","products":["Unknown MasterStudy LMS WordPress Plugin"],"affected":[{"vendor":"Unknown","product":"MasterStudy LMS WordPress Plugin","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"3.7.46","versionType":"semver"}]}],"references":["https://wpscan.com/vulnerability/8738320c-eb44-46b9-b809-b5cb786cb3e4/"],"weaknesses":["CWE-200"],"ingestedAt":"2026-10-29T20:13:15.269Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/81xxx/CVE-2026-81197.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-81197","state":"PUBLISHED","datePublished":"2026-09-02T06:00:21.940Z","dateUpdated":"2026-09-02T10:45:55.590Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateReserved":"2026-08-26T16:31:27.331Z"},"containers":{"cna":{"title":"MasterStudy LMS < 3.7.46 - Unauthenticated Unpublished Course Title Disclosure via course-list REST Route","descriptions":[{"lang":"en","value":"The MasterStudy LMS WordPress Plugin  WordPress plugin before 3.7.46 does not restrict access to a REST route that lists an author's courses, nor does it filter that listing by publication status, allowing unauthenticated users to read the titles and IDs of unpublished (draft, pending and private) courses."}],"affected":[{"vendor":"Unknown","product":"MasterStudy LMS WordPress Plugin","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"3.7.46","versionType":"semver"}]}],"references":[{"url":"https://wpscan.com/vulnerability/8738320c-eb44-46b9-b809-b5cb786cb3e4/","tags":["exploit","vdb-entry","technical-description"]}],"problemTypes":[{"descriptions":[{"description":"CWE-200 Information Exposure","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateUpdated":"2026-09-02T06:00:21.940Z"},"credits":[{"lang":"en","value":"Revanth Hari Narayana Matte","type":"finder"},{"lang":"en","value":"WPScan","type":"coordinator"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"WPScan CVE Generator"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-81197","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-02T10:36:20.623651Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-200","lang":"en","type":"CWE","description":"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-02T10:45:55.590Z"}}]}}}