The MasterStudy LMS WordPress Plugin before version 3.7.46 does not properly verify authorization when retrieving order line-item data. This flaw allows any authenticated user, including those with Subscriber privileges, to access other instructors' course sales records by supplying a different instructor’s identifier. The impact is that sensitive sales information is disclosed to unauthorized users, representing a breach of confidentiality and an authorization bypass that aligns with CWE-639 weaknesses.

The vulnerability affects the MasterStudy LMS WordPress Plugin running on any WordPress installation. All versions earlier than 3.7.46 are susceptible, regardless of additional plugins or themes installed. The issue is tied to the plugin’s order-tracking functionality and specifically the handling of the author_id query parameter.

The vulnerability is exploitable by any authenticated user; the attack vector is inferred to be local to the WordPress site, requiring valid login credentials. The CVSS score is 4.3, the EPSS score is 0.00132, indicating a very low exploitation probability, and the issue is not listed in the CISA KEV catalog, making precise risk assessment difficult. Nevertheless, the potential for widespread information disclosure across all subscriber accounts warrants prompt remediation.