CVE-2026-81026 MasterStudy LMS < 3.7.40 - Unauthenticated Payment Bypass via PayPal IPN
Unauthenticated attackers can bypass payment verification to access paid content by submitting invalid PayPal IPN notifications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-81026?
CVE-2026-81026 is a medium-severity vulnerability in Unknown MasterStudy LMS WordPress Plugin, published on 29 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.40 does not verify the amount, receiver, currency or status of a payment notification before marking the corresponding order completed, allowing unauthenticated users to complete full-price orders and gain access to paid content by paying only a token amount.
Weakness: CWE-284
Which versions are affected by CVE-2026-81026?
How do I fix CVE-2026-81026?
No fix has been published for CVE-2026-81026 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-81026 being exploited?
There is no known exploitation of CVE-2026-81026 in the wild and no public exploit code.
Sources
Also known as GHSA-26xx-gp3p-fv9p.