Arbitrary File Inclusion Vulnerability in MasterStudy LMS Plugin for WordPress

CVE-2024-2411

What is CVE-2024-2411?

The MasterStudy LMS plugin for WordPress, developed by Stylemix Themes, is susceptible to a Local File Inclusion vulnerability that affects all versions up to and including 3.3.0. This issue arises through the 'modal' parameter, permitting unauthenticated attackers to include and execute arbitrary files on the server. The exploit allows for the execution of any PHP code contained within those files, posing a serious risk of bypassing access controls. Consequently, this vulnerability may lead to unauthorized access to sensitive data and potentially facilitate broader code execution attacks, exploiting scenarios where 'safe' file types like images can be uploaded and included.

References