Atomic Edge analysis of CVE-2026-28145: The MasterStudy LMS WordPress plugin, versions up to and including 3.7.39, contains a missing authorization vulnerability in its PayPal payment handling. This flaw allows an unauthenticated attacker to complete orders without valid payment verification, with a CVSS score of 5.3.
Root Cause: The vulnerable function is `check_payment` in `_core/lms/classes/paypal.php`. In versions prior to 3.7.40, this function processes incoming PayPal IPN (Instant Payment Notification) data without adequate validation. It accepts the `invoice` ID from the `$_REQUEST` superglobal, fetches the associated order, and if the status was not already ‘completed’, it directly updates the order status to ‘completed’ and calls `STM_LMS_Order::accept_order`. The code only checked PayPal’s response for a ‘VERIFIED’ string and did not validate the payment amount, currency, or receiver email against the actual order details. This missing authorization check allows a malicious actor to bypass genuine payment verification.
Exploitation: An unauthenticated attacker can exploit this by crafting a malicious POST request to the vulnerable endpoint. The endpoint is triggered when the `stm_lms_check_ipn` GET parameter is set, which leads to the `check_payment` function being called with the `$_REQUEST` data. The attacker sends a POST request to `/?stm_lms_check_ipn=1` with a valid order ID in the `invoice` parameter and `payment_status=Completed` and `txn_id=anything` in the request body. The plugin will verify the request against PayPal by echoing it back, but in an older vulnerable version, this check only uses a `curl` call to PayPal. Due to the missing validation on the order details, an attacker can emulate a successful payment by setting up a listener that returns a positive response to validation requests, or by simply sending a crafted request if the PayPal response check can be manipulated. A likely attack involves creating a false order or guessing/spiding an existing order ID, then sending a direct POST to the IPN endpoint with falsified transaction data. Since the vulnerable code does not check the amount or recipient, the bogus transaction will be accepted, and the order will be marked as complete.
Patch Analysis: The patch in version 3.7.40 adds a new private method, `is_valid_payment`, which is called before the PayPal IPN request is processed. This method introduces crucial authorization checks. It verifies the `$order_id` is a non-empty integer, that the post type is ‘stm-orders’, and that its status is ‘pending’. Furthermore, it requires the presence of specific PayPal IPN fields and validates that the reported `payment_status` is ‘completed’. It then compares the reported `mc_gross` (amount) and `mc_currency` (currency) against the order’s stored total and currency, using a small floating-point tolerance for the amount. Finally, it validates the `receiver_email` or `business` against a stored receiver, or falls back to the plugin’s configured receiver email. This comprehensive validation closes the authorization gap by ensuring that only legitimate, verified payments can complete an order.
Impact: Exploitation of this vulnerability enables a full purchase bypass. An attacker can gain access to premium course content and certifications without paying for them. This compromises the integrity of the learning platform and results in financial losses for the site owner. It also has a broader impact as any service or product integrated with the LMS that relies on completed order status can be accessed without legitimate payment.
