Masterstudy Lms Wordpress Plugin For Online Courses And Education
Monthly
Insecure Direct Object Reference in MasterStudy LMS WordPress Plugin (all versions through 3.7.14) allows authenticated Instructors to permanently delete media attachments belonging to any other WordPress user. The `stm_lms_delete_cover()` function accepts a caller-supplied `file_id` and passes it directly to WordPress's `wp_delete_attachment()` without verifying that the requesting user owns the referenced attachment. Because WordPress stores attachments with sequential integer IDs, an Instructor-level account holder can iterate over IDs to destroy course materials, profile images, or uploaded documents created by students, other instructors, or administrators. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Time-based blind SQL injection in MasterStudy LMS WordPress plugin up to version 3.7.25 allows authenticated subscribers and above to extract sensitive database information including user credentials and session tokens via unquoted ORDER BY clause injection in the /lms/stm-lms/order/items REST API endpoint. The vulnerability stems from a custom Query builder that concatenates user-supplied sort parameters containing parentheses directly into SQL ORDER BY clauses without proper quoting, bypassing the plugin's use of esc_sql(). CVSS score of 6.5 reflects network-accessible exploitation requiring low privilege (subscriber-level) authentication and no user interaction.
Insecure Direct Object Reference in MasterStudy LMS WordPress Plugin (all versions through 3.7.14) allows authenticated Instructors to permanently delete media attachments belonging to any other WordPress user. The `stm_lms_delete_cover()` function accepts a caller-supplied `file_id` and passes it directly to WordPress's `wp_delete_attachment()` without verifying that the requesting user owns the referenced attachment. Because WordPress stores attachments with sequential integer IDs, an Instructor-level account holder can iterate over IDs to destroy course materials, profile images, or uploaded documents created by students, other instructors, or administrators. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Time-based blind SQL injection in MasterStudy LMS WordPress plugin up to version 3.7.25 allows authenticated subscribers and above to extract sensitive database information including user credentials and session tokens via unquoted ORDER BY clause injection in the /lms/stm-lms/order/items REST API endpoint. The vulnerability stems from a custom Query builder that concatenates user-supplied sort parameters containing parentheses directly into SQL ORDER BY clauses without proper quoting, bypassing the plugin's use of esc_sql(). CVSS score of 6.5 reflects network-accessible exploitation requiring low privilege (subscriber-level) authentication and no user interaction.