Local File Inclusion Vulnerability in MasterStudy LMS Plugin for WordPress

CVE-2024-3136

Summary

The MasterStudy LMS plugin for WordPress is susceptible to Local File Inclusion due to a flaw in the 'template' parameter. This vulnerability allows unauthorized attackers to include and execute arbitrary files on the server, potentially leading to the execution of malicious PHP code. Such exploitation can bypass access controls, allow unauthorized access to sensitive information, and could enable the execution of unexpected code through file types that are generally considered safe for upload. All versions up to and including 3.3.3 are affected, highlighting the need for immediate action to secure these installations.

References