MasterStudy LMS

An authenticated Instructor can access names and email addresses of students on courses they do not own. The issue begins in version 3.6.2. The export does not identify the endpoint or course identifier field. Affected versions reported by the CNA: 3.6.2 to < 3.7.50. The export identifies 3.7.50 as fixed.

An authenticated Instructor can modify arbitrary orders through the REST interface, enabling free enrolment, revocation of paid access or alteration of order notes. The export does not identify the route or order parameter. Affected versions reported by the CNA: < 3.7.50. The export identifies 3.7.50 as fixed.

MasterStudy LMS before 3.7.46 returns a student's learning statistics without authorization. An unauthenticated attacker can retrieve course counts, points, certificates, quiz totals, and assignment totals for any registered user.

MasterStudy LMS before 3.7.46 does not verify ownership of curriculum objects. An authenticated instructor can delete or modify curriculum sections and materials belonging to courses owned by other instructors.

MasterStudy LMS before 3.7.46 leaves an author-course listing REST route unrestricted and does not filter results by publication status. An unauthenticated visitor can retrieve the titles and IDs of draft, pending, private, and published courses.

MasterStudy LMS before 3.7.46 does not verify ownership of quiz-question identifiers. An authenticated instructor can read questions belonging to other instructors, including correct answers and explanations.

MasterStudy LMS before 3.7.46 returns per-student course enrollment and progress data without authorization. An unauthenticated attacker can disclose the enrolled courses and learning progress of any registered user.

MasterStudy LMS before 3.7.46 does not correctly authorize order line-item requests. Any authenticated account, including a Subscriber, can supply another user's identifier and read other instructors' course sales records.

MasterStudy LMS before 3.7.43 uses an unauthenticated registration redirect value without validating its destination. An attacker can send users through the registration flow and redirect them to an arbitrary external site.

MasterStudy LMS before 3.7.42 does not restrict an instructor to orders they are entitled to view. An instructor can enumerate order IDs and retrieve another customer's name, email address, phone number, and postal address.

MasterStudy LMS before 3.7.40 marks an order complete without verifying the payment amount, receiver, currency, or status. An unauthenticated buyer can pay a token amount, complete a full-price order, and gain access to paid course content.

MasterStudy LMS through 3.7.42 permits an unauthenticated attacker to influence a file-deletion operation. The CNA rates the resulting availability impact as high and scope as changed.

MasterStudy LMS is affected by broken access control. Exploitation requires an authenticated subscriber account. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is n/a through 3.7.41.

MasterStudy LMS is affected by privilege escalation or authentication bypass. Exploitation requires an authenticated subscriber account. A successful request can grant permissions or access that the caller should not possess. The published affected range is n/a through 3.7.41.

MasterStudy LMS through 3.7.39 insufficiently verifies the authenticity of data used to change LMS user state. The advisory classifies the path as unauthenticated, so a visitor can trigger the state-manipulation behavior without a WordPress account.

MasterStudy LMS through 3.7.23 lets an authenticated Instructor call the wp_ajax_stm_lms_delete_cover action with the required nonce and an attacker-chosen sequential file_id. stm_lms_delete_cover() verifies only that a user is logged in and then passes file_id directly to wp_delete_attachment(..., true), without checking that the attachment is the caller's currently assigned cover. An Instructor can therefore permanently delete attachments belonging to other users. The CNA narrative says through 3.7.14, but its structured affected data says through 3.7.23; official tags confirm that 3.7.23 remains vulnerable and 3.7.24 introduces ownership and attachment-type validation.

MasterStudy LMS is affected by cross-site scripting. Exploitation requires an authenticated subscriber account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through 3.7.27.

MasterStudy LMS is affected by broken access control. Exploitation requires an authenticated subscriber account. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is n/a through 3.7.30.

MasterStudy LMS is affected by SQL injection. Exploitation requires an authenticated subscriber account. A successful request can alter database queries and expose or modify WordPress data. The published affected range is n/a through 3.7.25.

MasterStudy LMS is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data. The published affected range is <= 3.7.29.

MasterStudy LMS WordPress Plugin – for Online Courses and Education is affected by SQL injection. Exploitation requires an authenticated subscriber account. A successful request can alter database queries and expose or modify WordPress data. The published affected range is <= 3.7.25.

MasterStudy LMS is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.

MasterStudy LMS is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

MasterStudy LMS is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

MasterStudy LMS is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

MasterStudy LMS is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

MasterStudy LMS is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

MasterStudy LMS is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.

MasterStudy LMS is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Masterstudy Lms Learning Management System is affected by broken access control. Exposure depends on how the affected operation is made reachable by the site. A successful request can reach data or an operation that should be restricted to another user or a more privileged role.

Masterstudy Lms Learning Management System is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.