Advisories · Technology
MasterStudy LMS WordPress Plugin.
Every CVE that names MasterStudy LMS WordPress Plugin among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 2.7 Low
MasterStudy LMS 3.7.13 - 3.7.54 - Instructor+ Arbitrary User Display Name Update via Student Enrollment
- MasterStudy LMS WordPress Plugin
- Broken access control
- CVSS 4.3 Medium
MasterStudy LMS < 3.7.50 - Subscriber+ Lesson Completion Record Creation
- MasterStudy LMS WordPress Plugin
- Broken access control
- CVSS 5.3 Medium
MasterStudy LMS 2.3.0 - < 3.7.50 - Unauthenticated Account Creation with Registration Disabled
- MasterStudy LMS WordPress Plugin
- Broken access control
- CVSS 4.3 Medium
MasterStudy LMS 2.3.0 - < 3.7.50 - Subscriber+ Course and Lesson Creation via Demo Import
- MasterStudy LMS WordPress Plugin
- Broken access control
- CVSS 7.2 High
MasterStudy LMS 3.5.29 - < 3.7.50 - Contributor+ LFI via Elementor Courses Categories Widget
- MasterStudy LMS WordPress Plugin
- Path traversal
- CVSS 4.3 Medium
MasterStudy LMS < 3.7.50 - Subscriber+ Quiz Attempt Grade Disclosure via IDOR
- MasterStudy LMS WordPress Plugin
- Broken access control
- CVSS 4.6 Medium
MasterStudy LMS < 3.7.50 - Subscriber+ Stored HTML Injection via Course Discussions
- MasterStudy LMS WordPress Plugin
- CWE-345
- CVSS 2.7 Low
MasterStudy LMS 3.6.2 - < 3.7.50 - Instructor+ Student PII Disclosure via IDOR
- MasterStudy LMS WordPress Plugin
- Broken access control
- CVSS 3.8 Low
MasterStudy LMS < 3.7.50 - Instructor+ Order Status Manipulation via IDOR
- MasterStudy LMS WordPress Plugin
- Broken access control
- CVSS 5.3 Medium
MasterStudy LMS < 3.7.46 - Unauthenticated Student Statistics Disclosure via student/stats REST Route
- MasterStudy LMS WordPress Plugin
- Information disclosure
- CVSS 3.8 Low
MasterStudy LMS < 3.7.46 - Instructor+ Cross-Course Curriculum Deletion and Tampering via IDOR
- MasterStudy LMS WordPress Plugin
- Broken access control
- CVSS 5.3 Medium
MasterStudy LMS < 3.7.46 - Unauthenticated Unpublished Course Title Disclosure via course-list REST Route
- MasterStudy LMS WordPress Plugin
- Information disclosure
- CVSS 2.7 Low
MasterStudy LMS < 3.7.46 - Instructor+ Quiz Answer Disclosure via IDOR
- MasterStudy LMS WordPress Plugin
- Broken access control
- CVSS 5.3 Medium
MasterStudy LMS < 3.7.46 - Unauthenticated Student Enrollment Disclosure via student-courses REST Route
- MasterStudy LMS WordPress Plugin
- Information disclosure
- CVSS 4.3 Medium
MasterStudy LMS < 3.7.46 - Subscriber+ Cross-Instructor Order Data Disclosure via author_id Parameter
- MasterStudy LMS WordPress Plugin
- Broken access control
- CVSS 4.7 Medium
MasterStudy LMS < 3.7.43 - Unauthenticated Open Redirect
- MasterStudy LMS WordPress Plugin
- Open redirect
- CVSS 2.7 Low
MasterStudy LMS < 3.7.42 - Instructor+ Cross-Tenant Order Billing PII Disclosure via IDOR
- MasterStudy LMS WordPress Plugin
- Broken access control
- CVSS 4.8 Medium
MasterStudy LMS < 3.7.40 - Unauthenticated Payment Bypass via PayPal IPN
- MasterStudy LMS WordPress Plugin
- Broken access control
- CVSS 9.1 CriticalCritical · CVSS 9+
MasterStudy LMS < 3.3.24 - Privilege Escalation to Instructor
- MasterStudy LMS WordPress Plugin
- CVSS 7.5 High
MasterStudy LMS < 3.0.18 - Unauthenticated Instructor Account Creation
- MasterStudy LMS WordPress Plugin