Medium severity · published May 2, 2024
CVE-2024-3942
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.3.8 - Missing Authorization
5.4
CVSS
0.4%
EPSS
No
On KEV
Description
The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on several functions in versions up to, and including, 3.3.8. This makes it possible for authenticated attackers, with subscriber level permissions and above, to read and modify content such as course questions, post titles, and taxonomies.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ML
MasterStudy LMS WordPress Plugin – for Online Courses and Education · stylemix
through 3.3.8 · source: vendor
ML
Masterstudy Lms · Stylemixthemes
before 3.3.9 · source: NVD
Affected product
ML
MasterStudy LMS WordPress Plugin – for Online Courses and Education
stylemix
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-3942
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-3942
Product
https://plugins.trac.wordpress.org/changeset/3078394/
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/64eb3d67-7056-4a03-ba3b-a04c2e96648d?source=cve
More from MasterStudy LMS WordPress Plugin – for Online Courses and Education
9.8
CVE-2024-3136
MasterStudy LMS <= 3.3.3 - Unauthenticated Local File Inclusion via template
9.8
CVE-2024-2411
MasterStudy LMS <= 3.3.0 - Unauthenticated Local File Inclusion via modal
9.8
CVE-2024-2409
MasterStudy LMS <= 3.3.1 - Unauthenticated Privilege Escalation via stm_lms_register AJAX Action
9.8
CVE-2024-1512
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.5 - Unauthenticated SQL Injection
7.5
CVE-2024-2106
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.10 - Basic Information Exposure via REST route