CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
Broken Access Control vulnerability in StylemixThemes MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin <= 3.0.8 versions allows any logged-in users, such as subscribers to view the "Orders" of the plugin and get the data related to the order like email, username, and more.
Explanation of Vulnerability in Simple Terms
The MasterStudy LMS WordPress plugin through version 3.0.8 fails to properly check user permissions before allowing access to sensitive course and student data. An attacker with a low-privilege account (such as a student or subscriber) can read information they should not have access to, including other users' course progress, grades, and personal details. This affects the confidentiality of student records.
What an attacker can do
Read other users' course data, grades, and personal information without authorization.
Potential impact on your site
Student privacy is compromised; unauthorized users can view other students' grades and course progress.
Conditions required to exploit
Attacker must have a low-privilege WordPress account (student, subscriber, or similar role).
Key dates
External resources
Related vulnerabilities
