Description

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning per-student course enrollment and progress data, allowing unauthenticated attackers to disclose the enrolled courses and learning progress of any registered user.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-02T06:17:18.680Z",
  "pubdate": "2026-09-02T06:17:18.680Z",
  "executiveSummary": "The MasterStudy LMS WordPress plugin is susceptible to an unauthorized data disclosure vulnerability due to a lack of proper authorization checks on sensitive API endpoints.\nThe vulnerability allows unauthenticated attackers to access and exfiltrate private student enrollment data and granular course progress metrics for any registered user on the platform.\nThis issue affects MasterStudy LMS WordPress plugin versions prior to 3.7.46.\nThe risk is categorized as high, as it leads to a breach of student privacy and potentially leaks PII (Personally Identifiable Information) regarding user learning activities.\nExploitation does not require prior authentication, meaning any network-connected actor can query the vulnerable endpoint without valid credentials.\nThe impact includes exposure of sensitive user behavior patterns, academic progress, and user enrollment status, which could be leveraged for targeted phishing or further reconnaissance against the WordPress site users.",
  "technicalDetails": "The vulnerability stems from an insecure implementation of an endpoint within the MasterStudy LMS plugin that exposes per-student course enrollment and progress telemetry. The root cause is a failure to perform server-side authorization checks, specifically neglecting to verify the session or user privileges before processing requests to the vulnerable API.\nIn a secure implementation, the system should validate the requester's identity, ensuring that users can only access data belonging to their own account or that an administrative session is established for broader queries. In the affected versions, the plugin fails to enforce these access controls, allowing any unauthenticated remote user to successfully invoke these data retrieval functions.\nThe attack flow involves an attacker identifying the specific API endpoint responsible for fetching student data. Because the system lacks an 'is_user_logged_in()' or a similar capability check, the plugin returns the requested JSON payload containing user-specific information. An attacker can iterate through user IDs or other identifiers to systematically harvest the learning progress and course rosters of the entire user base.\nThe vulnerable component resides within the plugin's REST API or AJAX request handling logic, which is designed to serve data to the front-end user interface. Since this logic is exposed to the public API layer without authentication middleware, the server treats requests as legitimate regardless of the source. The payload behavior is passive; it does not modify the integrity of the data but acts as a read-only exfiltration mechanism.\nPost-exploitation, an attacker gains visibility into the educational activities of platform users. This information is highly valuable for building profiles on target users. By mapping course progress and enrollment data, attackers can perform targeted social engineering attacks, such as impersonating platform administrators or using specific course-related themes to enhance phishing emails. Given that WordPress sites often store user metadata, the disclosure of course progress can also be combined with other vulnerabilities to escalate access or enumerate the internal user database."
}