{"cve":{"cve_id":"CVE-2026-81197","is_kev":false,"kev_date_added":null,"kev_vendor_project":null,"kev_product":null,"kev_vulnerability_name":null,"kev_short_description":null,"kev_required_action":null,"kev_due_date":null,"kev_known_ransomware":null,"kev_notes":null,"kev_cwes":null,"epss_score":0.00206,"epss_percentile":0.10889,"epss_as_of":"2026-09-15","description":"The MasterStudy LMS WordPress Plugin  WordPress plugin before 3.7.46 does not restrict access to a REST route that lists an author's courses, nor does it filter that listing by publication status, allowing unauthenticated users to read the titles and IDs of unpublished (draft, pending and private) courses.","published_at":"2026-09-02T06:00:21.940000Z","last_modified_at":"2026-09-03T17:50:37.690000Z","cvss_v3_score":5.3,"cvss_v3_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_v3_severity":"MEDIUM","cvss_v4_score":null,"cvss_v4_vector":null,"cvss_v4_severity":null,"ssvc_decision":null,"ssvc_exploitation":"none","ssvc_automatable":true,"ssvc_technical_impact":"partial","cwes":["CWE-200"],"nvd_references":["https://wpscan.com/vulnerability/8738320c-eb44-46b9-b809-b5cb786cb3e4/"],"vuln_status":"Deferred","trending_score":null,"is_trending":false,"has_trended":false,"trended_number_one":false,"trending_peak_score":null,"trending_peak_rank":null,"started_trending_at":null,"trended_number_one_at":null,"summary_generated":null,"summary_generated_at":null,"summary_model":null,"created_at":"2026-09-02T06:34:30.376828Z","updated_at":"2026-09-05T03:43:45.382026Z"},"effective_severity":"MEDIUM","badges":[],"impact_analysis":[],"cvss_v3_decoded":{"version":"3.1","metrics":[{"metric":"AV","name":"Attack Vector","value":"N","value_label":"Network"},{"metric":"AC","name":"Attack Complexity","value":"L","value_label":"Low"},{"metric":"PR","name":"Privileges Required","value":"N","value_label":"None"},{"metric":"UI","name":"User Interaction","value":"N","value_label":"None"},{"metric":"S","name":"Scope","value":"U","value_label":"Unchanged"},{"metric":"C","name":"Confidentiality","value":"L","value_label":"Low"},{"metric":"I","name":"Integrity","value":"N","value_label":"None"},{"metric":"A","name":"Availability","value":"N","value_label":"None"}]},"cvss_v4_decoded":{"version":null,"metrics":[]},"affected":[{"vendor_slug":"unknown","vendor_name":"Unknown","product_slug":"masterstudy-lms-wordpress-plugin","product_name":"MasterStudy LMS WordPress Plugin","version_start":"0","version_start_inclusive":true,"version_end":"3.7.46","version_end_inclusive":false,"cpe23_uri":"cve5:unknown:masterstudy-lms-wordpress-plugin:0:3.7.46"}],"exploit_refs":[],"news":[],"references":[{"url":"https://wpscan.com/vulnerability/8738320c-eb44-46b9-b809-b5cb786cb3e4/","source_type":"MISC","tags":[]}],"timeline":[{"type":"published","at":"2026-09-02T06:00:21.940000Z","label":"CVE published","source":null},{"type":"ssvc_changed","at":"2026-09-02T11:35:30.376819Z","label":"SSVC decision revised","source":"vulnrichment"},{"type":"ssvc_changed","at":"2026-09-02T11:35:30.376819Z","label":"SSVC decision revised","source":"vulnrichment"},{"type":"ssvc_changed","at":"2026-09-02T11:35:30.376819Z","label":"SSVC decision revised","source":"vulnrichment"},{"type":"cvss_changed","at":"2026-09-02T11:35:30.376819Z","label":"CVSS score revised","source":"vulnrichment"},{"type":"cvss_changed","at":"2026-09-02T11:35:30.376819Z","label":"CVSS score revised","source":"vulnrichment"},{"type":"cvss_changed","at":"2026-09-02T11:35:30.376819Z","label":"CVSS score revised","source":"vulnrichment"}]}