Medium severity4.8NVD Advisory· Published Aug 29, 2026· Updated Aug 31, 2026
CVE-2026-81026
CVE-2026-81026
Description
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.40 does not verify the amount, receiver, currency or status of a payment notification before marking the corresponding order completed, allowing unauthenticated users to complete full-price orders and gain access to paid content by paying only a token amount.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <3.7.40
Patches
Vulnerability mechanics
References
1News mentions
2- Wordfence Intelligence Weekly WordPress Vulnerability Report (August 24, 2026 to August 30, 2026)Wordfence Blog · Sep 3, 2026
- WordPress Plugins: 25 Vulnerabilities Disclosed, Including Critical Auth Bypass and RCE FlawsVypr Intelligence · Aug 30, 2026