WordPress security changelog
HIGH CVE-2024-10008 Analyzed

Masteriyo LMS – eLearning and Online Course Builder for: A security weakness

Masteriyo LMS – eLearning and Online Course Builder for is affected by a security weakness. Exploitation requires an authenticated WordPress account. The resulting impact depends on how the affected component exposes the vulnerable operation.

CVE / CNA score 8.8 CVSS 3.1 · security@wordfence.com
NVD score 6.5 CVSS 3.1 · nvd@nist.gov
Component
Masteriyo LMS – eLearning and Online Course Builder for
Plugin slug
learning-management-system
Affected
See vendor advisory
Safe version
See mitigation notes
Published
Oct 29, 2024
Weakness
CWE-862 — Missing Authorization

This CVE was published Oct 29, 2024 and is one of 14 known issues for this plugin.

Patch or disable the affected component.

Update Masteriyo LMS – eLearning and Online Course Builder for to a release outside the affected range, or disable and remove it until a fixed version is available.

Technical description

The Masteriyo LMS – eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to unauthorized user profile modification due to missing authorization checks on the /wp-json/masteriyo/v1/users/$id REST API endpoint in all versions up to, and including, 1.13.3. This makes it possible for authenticated attackers, with student-level access and above, to modify the roles of arbitrary users. As a result, attackers can escalate their privileges to the Administrator and demote existing administrators to students.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Primary and upstream sources