Masterstudy Lms Wordpress Plugin
Monthly
Authenticated local file inclusion and code execution affects the MasterStudy LMS WordPress plugin in versions from 3.5.29 up to (but not including) 3.7.50, where one display-style setting is used to build a template path without validation. Exploitation requires an authenticated WordPress account with the Contributor role or higher, and turns into arbitrary PHP execution only when a suitable PHP file already exists on the server. Publicly available exploit code exists (WPScan), but there is no confirmed active exploitation (not in CISA KEV) and SSVC rates exploitation as none and non-automatable, making this a high-priority, manually driven issue rather than an emergency; this is especially true for sites that do not permit untrusted users to register at Contributor level or above.
Broken access control in the MasterStudy LMS WordPress plugin (versions 3.7.13 up to but not including 3.7.55) lets an authenticated user who holds the Instructor role rename any account on the site - first name, last name and public display name - including administrator accounts, opening the door to impersonation and phishing. The plugin's student-enrolment feature does not check that the targeted user has any relationship to the requesting instructor, so the only barrier is obtaining Instructor-level access; there is no confidentiality or availability impact and no ability to change credentials or privileges. Severity is low (assessed CVSS 2.7, PR:L), there is no CISA KEV entry or other signal of active exploitation, and a public PoC reference exists but is not verified as working exploit code; priority is monitor.
Missing authorization checks in the MasterStudy LMS WordPress plugin before 3.7.50 let any authenticated user - including a self-registered subscriber - record lesson completions for courses they are not enrolled in, corrupting course-progress and completion data. Exploitation requires only a low-privilege account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N), with no administrative rights and no user interaction, and publicly available exploit code exists (no CISA KEV entry, so confirmed active exploitation is not established). Impact is limited to integrity of progress records - there is no confidentiality or availability effect - making this a genuine but low-severity data-integrity flaw rather than an emergency.
Unauthenticated account creation in the MasterStudy LMS WordPress plugin (versions 2.3.0 through before 3.7.50) lets remote attackers create user accounts - and be logged into them - on WordPress sites where the administrator has deliberately disabled user registration. The plugin's front-end registration flow fails to consult the site's registration setting before creating the account (CWE-862, missing authorization), so the restriction the administrator put in place is simply not enforced; publicly available exploit code exists, though there is no confirmation of active exploitation (no CISA KEV listing, and CISA's SSVC assessment records exploitation as 'none'). Exploitation is unauthenticated and needs no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), but the impact is capped at subscriber-level account creation with no confidentiality or availability effect, making this a genuine but low-to-moderate priority issue.
Any authenticated WordPress user - down to the lowest-privilege Subscriber role - can invoke an administrative maintenance action in the MasterStudy LMS plugin (versions 2.3.0 through before 3.7.50) because the handler performs no capability check and no nonce verification, resulting in published content created and attributed to the attacker's own account. The network-reachable, PR:L vector (CVSS 3.1 4.3, CWE-862) means the only real prerequisite is obtaining a login, which is trivial on LMS sites that permit open self-service registration and a genuine limiter where registration is closed; no user interaction or admin rights are needed, and the assessed impact is integrity-only. Publicly available exploit code exists via the WPScan advisory, but there is no CISA KEV listing and SSVC rates exploitation as none, so this is a low-to-moderate priority finding rather than an actively exploited one; a vendor patch is available in 3.7.50.
MasterStudy LMS WordPress plugin before 3.7.50 fails to verify that an Instructor-role user owns a course before returning its enrolled-student data, allowing disclosure of student names and email addresses for other instructors' courses. Publicly available exploit code exists, and vendor has released patched version 3.7.50. The independent assessment rates this as genuinely low severity (CVSS 2.7) because exploitation requires an authenticated Instructor account and only exposes limited personal data with no write or privilege-escalation impact.
Broken object-level authorization in the MasterStudy LMS WordPress plugin before 3.7.50 lets an authenticated user holding the Instructor role modify any order on the site through the plugin's order REST API, enabling free course enrolment, revocation of other users' paid enrolments, and tampering with order notes. The flaw is an IDOR (CWE-639) reachable remotely over the network with low privileges required and no victim interaction; publicly available exploit code exists, though there is no confirmation of active exploitation (CISA KEV). Our assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) places this at moderate severity, with the Instructor account requirement being the principal real-world constraint.
Unauthenticated information disclosure in MasterStudy LMS WordPress Plugin before 3.7.46 exposes learning statistics for any registered user without authorization. The plugin's student statistics endpoint performs no access control check, allowing any remote attacker to retrieve course counts, accumulated points, certificates, quiz totals, and assignment totals for arbitrary user accounts. A publicly available exploit exists per WPScan, and the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required.
Cross-instructor content tampering in MasterStudy LMS WordPress Plugin before 3.7.46 allows authenticated instructor-role users to delete or modify curriculum sections and materials belonging to courses owned by other instructors. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the plugin performs operations on curriculum objects without confirming the requesting instructor owns the parent course. A publicly available proof-of-concept exists via WPScan; no active exploitation (CISA KEV) has been recorded, and the CVSS score of 3.8 reflects the restricted impact scope.
Unauthenticated information disclosure in MasterStudy LMS WordPress Plugin before 3.7.46 exposes the titles and IDs of an author's unpublished courses - including draft, pending, and private posts - through an unprotected REST API endpoint. The affected route performs no access control check and applies no publication-status filter, meaning any unauthenticated network request can enumerate course content that site owners intended to keep hidden. A publicly available proof-of-concept exists per the WPScan advisory; no active exploitation has been confirmed in CISA KEV at time of analysis.
Instructors in MasterStudy LMS WordPress Plugin versions before 3.7.46 can read quiz questions, correct answers, and explanations belonging to other instructors by supplying arbitrary question identifiers in plugin requests. The root cause is CWE-639 (IDOR - Authorization Through User-Controlled Key): the plugin exposes question IDs without verifying that the requesting instructor owns them. A public proof-of-concept is available via WPScan, and a vendor patch has been released at version 3.7.46.
Unauthenticated information disclosure in MasterStudy LMS WordPress Plugin (all versions before 3.7.46) exposes per-student course enrollment and learning progress data to any remote attacker without credentials. The plugin fails to perform an authorization check before returning student-specific data, allowing enumeration of any registered user's enrolled courses and progress metrics. A publicly available exploit exists via WPScan; no active exploitation (KEV) has been confirmed, and the CVSS 5.3 score accurately reflects limited confidentiality impact.
Broken object-level authorization in MasterStudy LMS WordPress Plugin before 3.7.46 exposes course sales records of any instructor to any authenticated WordPress user. The plugin's order line-item retrieval endpoint accepts a user-supplied identifier without verifying that the requesting user is the record owner, enabling subscriber-level accounts to enumerate and read other instructors' transaction histories. A publicly available exploit exists per WPScan, and the fix is present in version 3.7.46.
Open redirect in MasterStudy LMS WordPress Plugin before version 3.7.43 enables unauthenticated attackers to supply an unvalidated redirect parameter during user registration, silently forwarding newly registered users to arbitrary external URLs. This creates a reliable phishing vector: an attacker crafts a registration link pointing to a spoofed login page, and the plugin delivers the victim there immediately post-registration without warning. A publicly available proof-of-concept exists per WPScan, though the EPSS score of 0.14% (3rd percentile) indicates exploitation has not yet become widespread or automated.
MasterStudy LMS WordPress Plugin versions before 3.7.42 expose order billing records - including customer names, email addresses, phone numbers, and postal addresses - to any authenticated user holding the instructor role, via insecure direct object reference on order IDs. An instructor can iterate through order IDs in the plugin's order-detail endpoint to retrieve billing information belonging to arbitrary other users without any administrative interaction. A publicly available proof-of-concept exists per WPScan, though no confirmed active exploitation has been observed and the EPSS probability remains extremely low at 0.13%.
Payment verification bypass in MasterStudy LMS WordPress Plugin before 3.7.40 permits unauthenticated attackers to fraudulently complete full-price course orders by submitting payment webhook notifications with only a token amount. The plugin neglects to validate the transaction amount, receiving account, currency, or payment status before updating order state to completed, granting unauthorized access to paid LMS content. A public proof-of-concept is available via WPScan, though EPSS remains low at 0.15% (4th percentile) and no CISA KEV listing has been confirmed.
Authenticated local file inclusion and code execution affects the MasterStudy LMS WordPress plugin in versions from 3.5.29 up to (but not including) 3.7.50, where one display-style setting is used to build a template path without validation. Exploitation requires an authenticated WordPress account with the Contributor role or higher, and turns into arbitrary PHP execution only when a suitable PHP file already exists on the server. Publicly available exploit code exists (WPScan), but there is no confirmed active exploitation (not in CISA KEV) and SSVC rates exploitation as none and non-automatable, making this a high-priority, manually driven issue rather than an emergency; this is especially true for sites that do not permit untrusted users to register at Contributor level or above.
Broken access control in the MasterStudy LMS WordPress plugin (versions 3.7.13 up to but not including 3.7.55) lets an authenticated user who holds the Instructor role rename any account on the site - first name, last name and public display name - including administrator accounts, opening the door to impersonation and phishing. The plugin's student-enrolment feature does not check that the targeted user has any relationship to the requesting instructor, so the only barrier is obtaining Instructor-level access; there is no confidentiality or availability impact and no ability to change credentials or privileges. Severity is low (assessed CVSS 2.7, PR:L), there is no CISA KEV entry or other signal of active exploitation, and a public PoC reference exists but is not verified as working exploit code; priority is monitor.
Missing authorization checks in the MasterStudy LMS WordPress plugin before 3.7.50 let any authenticated user - including a self-registered subscriber - record lesson completions for courses they are not enrolled in, corrupting course-progress and completion data. Exploitation requires only a low-privilege account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N), with no administrative rights and no user interaction, and publicly available exploit code exists (no CISA KEV entry, so confirmed active exploitation is not established). Impact is limited to integrity of progress records - there is no confidentiality or availability effect - making this a genuine but low-severity data-integrity flaw rather than an emergency.
Unauthenticated account creation in the MasterStudy LMS WordPress plugin (versions 2.3.0 through before 3.7.50) lets remote attackers create user accounts - and be logged into them - on WordPress sites where the administrator has deliberately disabled user registration. The plugin's front-end registration flow fails to consult the site's registration setting before creating the account (CWE-862, missing authorization), so the restriction the administrator put in place is simply not enforced; publicly available exploit code exists, though there is no confirmation of active exploitation (no CISA KEV listing, and CISA's SSVC assessment records exploitation as 'none'). Exploitation is unauthenticated and needs no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), but the impact is capped at subscriber-level account creation with no confidentiality or availability effect, making this a genuine but low-to-moderate priority issue.
Any authenticated WordPress user - down to the lowest-privilege Subscriber role - can invoke an administrative maintenance action in the MasterStudy LMS plugin (versions 2.3.0 through before 3.7.50) because the handler performs no capability check and no nonce verification, resulting in published content created and attributed to the attacker's own account. The network-reachable, PR:L vector (CVSS 3.1 4.3, CWE-862) means the only real prerequisite is obtaining a login, which is trivial on LMS sites that permit open self-service registration and a genuine limiter where registration is closed; no user interaction or admin rights are needed, and the assessed impact is integrity-only. Publicly available exploit code exists via the WPScan advisory, but there is no CISA KEV listing and SSVC rates exploitation as none, so this is a low-to-moderate priority finding rather than an actively exploited one; a vendor patch is available in 3.7.50.
MasterStudy LMS WordPress plugin before 3.7.50 fails to verify that an Instructor-role user owns a course before returning its enrolled-student data, allowing disclosure of student names and email addresses for other instructors' courses. Publicly available exploit code exists, and vendor has released patched version 3.7.50. The independent assessment rates this as genuinely low severity (CVSS 2.7) because exploitation requires an authenticated Instructor account and only exposes limited personal data with no write or privilege-escalation impact.
Broken object-level authorization in the MasterStudy LMS WordPress plugin before 3.7.50 lets an authenticated user holding the Instructor role modify any order on the site through the plugin's order REST API, enabling free course enrolment, revocation of other users' paid enrolments, and tampering with order notes. The flaw is an IDOR (CWE-639) reachable remotely over the network with low privileges required and no victim interaction; publicly available exploit code exists, though there is no confirmation of active exploitation (CISA KEV). Our assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) places this at moderate severity, with the Instructor account requirement being the principal real-world constraint.
Unauthenticated information disclosure in MasterStudy LMS WordPress Plugin before 3.7.46 exposes learning statistics for any registered user without authorization. The plugin's student statistics endpoint performs no access control check, allowing any remote attacker to retrieve course counts, accumulated points, certificates, quiz totals, and assignment totals for arbitrary user accounts. A publicly available exploit exists per WPScan, and the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required.
Cross-instructor content tampering in MasterStudy LMS WordPress Plugin before 3.7.46 allows authenticated instructor-role users to delete or modify curriculum sections and materials belonging to courses owned by other instructors. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the plugin performs operations on curriculum objects without confirming the requesting instructor owns the parent course. A publicly available proof-of-concept exists via WPScan; no active exploitation (CISA KEV) has been recorded, and the CVSS score of 3.8 reflects the restricted impact scope.
Unauthenticated information disclosure in MasterStudy LMS WordPress Plugin before 3.7.46 exposes the titles and IDs of an author's unpublished courses - including draft, pending, and private posts - through an unprotected REST API endpoint. The affected route performs no access control check and applies no publication-status filter, meaning any unauthenticated network request can enumerate course content that site owners intended to keep hidden. A publicly available proof-of-concept exists per the WPScan advisory; no active exploitation has been confirmed in CISA KEV at time of analysis.
Instructors in MasterStudy LMS WordPress Plugin versions before 3.7.46 can read quiz questions, correct answers, and explanations belonging to other instructors by supplying arbitrary question identifiers in plugin requests. The root cause is CWE-639 (IDOR - Authorization Through User-Controlled Key): the plugin exposes question IDs without verifying that the requesting instructor owns them. A public proof-of-concept is available via WPScan, and a vendor patch has been released at version 3.7.46.
Unauthenticated information disclosure in MasterStudy LMS WordPress Plugin (all versions before 3.7.46) exposes per-student course enrollment and learning progress data to any remote attacker without credentials. The plugin fails to perform an authorization check before returning student-specific data, allowing enumeration of any registered user's enrolled courses and progress metrics. A publicly available exploit exists via WPScan; no active exploitation (KEV) has been confirmed, and the CVSS 5.3 score accurately reflects limited confidentiality impact.
Broken object-level authorization in MasterStudy LMS WordPress Plugin before 3.7.46 exposes course sales records of any instructor to any authenticated WordPress user. The plugin's order line-item retrieval endpoint accepts a user-supplied identifier without verifying that the requesting user is the record owner, enabling subscriber-level accounts to enumerate and read other instructors' transaction histories. A publicly available exploit exists per WPScan, and the fix is present in version 3.7.46.
Open redirect in MasterStudy LMS WordPress Plugin before version 3.7.43 enables unauthenticated attackers to supply an unvalidated redirect parameter during user registration, silently forwarding newly registered users to arbitrary external URLs. This creates a reliable phishing vector: an attacker crafts a registration link pointing to a spoofed login page, and the plugin delivers the victim there immediately post-registration without warning. A publicly available proof-of-concept exists per WPScan, though the EPSS score of 0.14% (3rd percentile) indicates exploitation has not yet become widespread or automated.
MasterStudy LMS WordPress Plugin versions before 3.7.42 expose order billing records - including customer names, email addresses, phone numbers, and postal addresses - to any authenticated user holding the instructor role, via insecure direct object reference on order IDs. An instructor can iterate through order IDs in the plugin's order-detail endpoint to retrieve billing information belonging to arbitrary other users without any administrative interaction. A publicly available proof-of-concept exists per WPScan, though no confirmed active exploitation has been observed and the EPSS probability remains extremely low at 0.13%.
Payment verification bypass in MasterStudy LMS WordPress Plugin before 3.7.40 permits unauthenticated attackers to fraudulently complete full-price course orders by submitting payment webhook notifications with only a token amount. The plugin neglects to validate the transaction amount, receiving account, currency, or payment status before updating order state to completed, granting unauthorized access to paid LMS content. A public proof-of-concept is available via WPScan, though EPSS remains low at 0.15% (4th percentile) and no CISA KEV listing has been confirmed.