Masterstudy Lms Wordpress Plugin
Monthly
Unauthenticated information disclosure in MasterStudy LMS WordPress Plugin before 3.7.46 exposes learning statistics for any registered user without authorization. The plugin's student statistics endpoint performs no access control check, allowing any remote attacker to retrieve course counts, accumulated points, certificates, quiz totals, and assignment totals for arbitrary user accounts. A publicly available exploit exists per WPScan, and the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required.
Cross-instructor content tampering in MasterStudy LMS WordPress Plugin before 3.7.46 allows authenticated instructor-role users to delete or modify curriculum sections and materials belonging to courses owned by other instructors. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the plugin performs operations on curriculum objects without confirming the requesting instructor owns the parent course. A publicly available proof-of-concept exists via WPScan; no active exploitation (CISA KEV) has been recorded, and the CVSS score of 3.8 reflects the restricted impact scope.
Unauthenticated information disclosure in MasterStudy LMS WordPress Plugin before 3.7.46 exposes the titles and IDs of an author's unpublished courses - including draft, pending, and private posts - through an unprotected REST API endpoint. The affected route performs no access control check and applies no publication-status filter, meaning any unauthenticated network request can enumerate course content that site owners intended to keep hidden. A publicly available proof-of-concept exists per the WPScan advisory; no active exploitation has been confirmed in CISA KEV at time of analysis.
Instructors in MasterStudy LMS WordPress Plugin versions before 3.7.46 can read quiz questions, correct answers, and explanations belonging to other instructors by supplying arbitrary question identifiers in plugin requests. The root cause is CWE-639 (IDOR - Authorization Through User-Controlled Key): the plugin exposes question IDs without verifying that the requesting instructor owns them. A public proof-of-concept is available via WPScan, and a vendor patch has been released at version 3.7.46.
Unauthenticated information disclosure in MasterStudy LMS WordPress Plugin (all versions before 3.7.46) exposes per-student course enrollment and learning progress data to any remote attacker without credentials. The plugin fails to perform an authorization check before returning student-specific data, allowing enumeration of any registered user's enrolled courses and progress metrics. A publicly available exploit exists via WPScan; no active exploitation (KEV) has been confirmed, and the CVSS 5.3 score accurately reflects limited confidentiality impact.
Broken object-level authorization in MasterStudy LMS WordPress Plugin before 3.7.46 exposes course sales records of any instructor to any authenticated WordPress user. The plugin's order line-item retrieval endpoint accepts a user-supplied identifier without verifying that the requesting user is the record owner, enabling subscriber-level accounts to enumerate and read other instructors' transaction histories. A publicly available exploit exists per WPScan, and the fix is present in version 3.7.46.
Open redirect in MasterStudy LMS WordPress Plugin before version 3.7.43 enables unauthenticated attackers to supply an unvalidated redirect parameter during user registration, silently forwarding newly registered users to arbitrary external URLs. This creates a reliable phishing vector: an attacker crafts a registration link pointing to a spoofed login page, and the plugin delivers the victim there immediately post-registration without warning. A publicly available proof-of-concept exists per WPScan, though the EPSS score of 0.14% (3rd percentile) indicates exploitation has not yet become widespread or automated.
MasterStudy LMS WordPress Plugin versions before 3.7.42 expose order billing records - including customer names, email addresses, phone numbers, and postal addresses - to any authenticated user holding the instructor role, via insecure direct object reference on order IDs. An instructor can iterate through order IDs in the plugin's order-detail endpoint to retrieve billing information belonging to arbitrary other users without any administrative interaction. A publicly available proof-of-concept exists per WPScan, though no confirmed active exploitation has been observed and the EPSS probability remains extremely low at 0.13%.
Payment verification bypass in MasterStudy LMS WordPress Plugin before 3.7.40 permits unauthenticated attackers to fraudulently complete full-price course orders by submitting payment webhook notifications with only a token amount. The plugin neglects to validate the transaction amount, receiving account, currency, or payment status before updating order state to completed, granting unauthorized access to paid LMS content. A public proof-of-concept is available via WPScan, though EPSS remains low at 0.15% (4th percentile) and no CISA KEV listing has been confirmed.
Unauthenticated information disclosure in MasterStudy LMS WordPress Plugin before 3.7.46 exposes learning statistics for any registered user without authorization. The plugin's student statistics endpoint performs no access control check, allowing any remote attacker to retrieve course counts, accumulated points, certificates, quiz totals, and assignment totals for arbitrary user accounts. A publicly available exploit exists per WPScan, and the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required.
Cross-instructor content tampering in MasterStudy LMS WordPress Plugin before 3.7.46 allows authenticated instructor-role users to delete or modify curriculum sections and materials belonging to courses owned by other instructors. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the plugin performs operations on curriculum objects without confirming the requesting instructor owns the parent course. A publicly available proof-of-concept exists via WPScan; no active exploitation (CISA KEV) has been recorded, and the CVSS score of 3.8 reflects the restricted impact scope.
Unauthenticated information disclosure in MasterStudy LMS WordPress Plugin before 3.7.46 exposes the titles and IDs of an author's unpublished courses - including draft, pending, and private posts - through an unprotected REST API endpoint. The affected route performs no access control check and applies no publication-status filter, meaning any unauthenticated network request can enumerate course content that site owners intended to keep hidden. A publicly available proof-of-concept exists per the WPScan advisory; no active exploitation has been confirmed in CISA KEV at time of analysis.
Instructors in MasterStudy LMS WordPress Plugin versions before 3.7.46 can read quiz questions, correct answers, and explanations belonging to other instructors by supplying arbitrary question identifiers in plugin requests. The root cause is CWE-639 (IDOR - Authorization Through User-Controlled Key): the plugin exposes question IDs without verifying that the requesting instructor owns them. A public proof-of-concept is available via WPScan, and a vendor patch has been released at version 3.7.46.
Unauthenticated information disclosure in MasterStudy LMS WordPress Plugin (all versions before 3.7.46) exposes per-student course enrollment and learning progress data to any remote attacker without credentials. The plugin fails to perform an authorization check before returning student-specific data, allowing enumeration of any registered user's enrolled courses and progress metrics. A publicly available exploit exists via WPScan; no active exploitation (KEV) has been confirmed, and the CVSS 5.3 score accurately reflects limited confidentiality impact.
Broken object-level authorization in MasterStudy LMS WordPress Plugin before 3.7.46 exposes course sales records of any instructor to any authenticated WordPress user. The plugin's order line-item retrieval endpoint accepts a user-supplied identifier without verifying that the requesting user is the record owner, enabling subscriber-level accounts to enumerate and read other instructors' transaction histories. A publicly available exploit exists per WPScan, and the fix is present in version 3.7.46.
Open redirect in MasterStudy LMS WordPress Plugin before version 3.7.43 enables unauthenticated attackers to supply an unvalidated redirect parameter during user registration, silently forwarding newly registered users to arbitrary external URLs. This creates a reliable phishing vector: an attacker crafts a registration link pointing to a spoofed login page, and the plugin delivers the victim there immediately post-registration without warning. A publicly available proof-of-concept exists per WPScan, though the EPSS score of 0.14% (3rd percentile) indicates exploitation has not yet become widespread or automated.
MasterStudy LMS WordPress Plugin versions before 3.7.42 expose order billing records - including customer names, email addresses, phone numbers, and postal addresses - to any authenticated user holding the instructor role, via insecure direct object reference on order IDs. An instructor can iterate through order IDs in the plugin's order-detail endpoint to retrieve billing information belonging to arbitrary other users without any administrative interaction. A publicly available proof-of-concept exists per WPScan, though no confirmed active exploitation has been observed and the EPSS probability remains extremely low at 0.13%.
Payment verification bypass in MasterStudy LMS WordPress Plugin before 3.7.40 permits unauthenticated attackers to fraudulently complete full-price course orders by submitting payment webhook notifications with only a token amount. The plugin neglects to validate the transaction amount, receiving account, currency, or payment status before updating order state to completed, granting unauthorized access to paid LMS content. A public proof-of-concept is available via WPScan, though EPSS remains low at 0.15% (4th percentile) and no CISA KEV listing has been confirmed.