CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
What the vulnerability does
The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on several functions in versions up to, and including, 3.3.8. This makes it possible for authenticated attackers, with subscriber level permissions and above, to read and modify content such as course questions, post titles, and taxonomies.
Explanation of Vulnerability in Simple Terms
The MasterStudy LMS WordPress plugin through version 3.3.8 fails to properly check user permissions before allowing access to certain functions. A logged-in user with low privileges can read, modify, or delete data they should not have access to. Site administrators should update the plugin immediately to a version newer than 3.3.8.
What an attacker can do
Read, modify, or delete course data and user information without proper authorization.
Potential impact on your site
Unauthorized users can access or alter course content, student records, and other sensitive LMS data.
Conditions required to exploit
Attacker must have a low-privilege account on the WordPress site (e.g., student or subscriber role).
Key dates
External resources
Related vulnerabilities
