Unauthorized Access and Data Modification in MasterStudy LMS Plugin for WordPress

CVE-2024-3942

Summary

The MasterStudy LMS WordPress Plugin for Online Courses is susceptible to unauthorized access and data manipulation due to a lack of necessary capability checks on various functions. This vulnerability affects all versions up to and including 3.3.8 and enables authenticated users with subscriber-level permissions to read and alter sensitive content, including course material, post titles, and taxonomy settings. This significant security gap highlights the need for vigilance and timely updates to maintain the integrity of educational platforms relying on this plugin.

References