WordPress security by component

MasterStudy LMS

Plugin description

MasterStudy LMS is a WordPress component with 11 published CVE records in this archive. The latest tracked vulnerability was published Jan 02, 2025; the highest CVE/CNA score is 9.8.

Plugin slug: masterstudy-lms

Latest vulnerability

CVE-2024-37093: MasterStudy LMS: Cross-site request forgery

MasterStudy LMS is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

PublishedJan 02, 2025

Safe version guidanceSee mitigation notes

		Safe version
Jan 02, 2025	CVE-2024-37093 MasterStudy LMS: Cross-site request forgery MasterStudy LMS is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.	See mitigation notes	CVE4.3 NVD8.8
Jul 22, 2024	CVE-2024-5973 MasterStudy LMS: A security weakness MasterStudy LMS is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE9.1 NVD8.8
May 02, 2024	CVE-2024-3942 MasterStudy LMS: A security weakness MasterStudy LMS is affected by a security weakness. Exploitation requires an authenticated WordPress account. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE6.3 NVD5.4
Apr 09, 2024	CVE-2024-3136 MasterStudy LMS: Filesystem traversal MasterStudy LMS is affected by filesystem traversal. The vulnerable path is reachable without authentication. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.	See mitigation notes	CVE9.8 NVDPending
Apr 09, 2024	CVE-2024-1904 MasterStudy LMS: A security weakness MasterStudy LMS is affected by a security weakness. Exploitation requires at least subscriber-level access. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE4.3 NVDPending
Mar 29, 2024	CVE-2024-2411 MasterStudy LMS: Filesystem traversal MasterStudy LMS is affected by filesystem traversal. The vulnerable path is reachable without authentication. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.	See mitigation notes	CVE9.8 NVDPending
Mar 29, 2024	CVE-2024-2409 MasterStudy LMS: Privilege escalation or authentication bypass MasterStudy LMS is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess.	See mitigation notes	CVE9.8 NVDPending
Mar 13, 2024	CVE-2024-2106 MasterStudy LMS: A security weakness MasterStudy LMS is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3 NVD7.5
Feb 17, 2024	CVE-2024-1512 MasterStudy LMS: SQL injection MasterStudy LMS is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE9.8 NVDPending
Sep 11, 2023	CVE-2023-4278 MasterStudy LMS: A security weakness MasterStudy LMS is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE7.5 NVD7.5
Mar 07, 2022	CVE-2022-0441 MasterStudy LMS: A security weakness MasterStudy LMS is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE9.8 NVD9.8