Description

WordPress Plugin MasterStudy LMS-for Online Courses and Education is prone to an information disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may help in launching further attacks. WordPress Plugin MasterStudy LMS-for Online Courses and Education version 3.2.10 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 3.2.11 or latest

References

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/masterstudy-lms-learning-management-system/masterstudy-lms-wordpress-plugin-for-online-courses-and-education-3210-basic-information-exposure-via-rest-route

https://docs.stylemixthemes.com/masterstudy-lms/changelog-free-version#id-3.2.11

Related Vulnerabilities

WordPress Plugin Responsive Products Showcase Listing for WordPress-WP Product Gallery Lite includes Backdoor [Only if downloaded via the vendor website] (1.1.1)

Jenkins Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2019-10353)

Apache Tomcat 7PK - Errors Vulnerability (CVE-2016-8745)

Liferay Portal CVE-2020-13444 Vulnerability (CVE-2020-13444)

Apache Tomcat Integer Overflow or Wraparound Vulnerability (CVE-2015-8751)

Severity

High

Classification

CVE-2024-2106 CWE-200 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update Information Disclosure