Description

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of quiz question identifiers, allowing users with instructor access to read other instructors' quiz questions, including the correct answers and explanations.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.7",
  "pubDate": "2026-09-02T06:17:18.777Z",
  "pubdate": "2026-09-02T06:17:18.777Z",
  "executiveSummary": "The MasterStudy LMS WordPress plugin before version 3.7.46 is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability. This flaw exists due to insufficient authorization checks when retrieving quiz question data. An authenticated user possessing instructor-level privileges can manipulate request identifiers to access quiz questions, including private metadata such as correct answers and detailed explanations, belonging to other instructors. The vulnerability exposes sensitive academic and intellectual property within the Learning Management System (LMS). Successful exploitation allows unauthorized access to proprietary course content without requiring elevated administrative privileges beyond the existing instructor account. This breach violates data isolation principles and compromises the integrity of quiz assessments across the platform.\nThe risk is categorized as significant for multi-instructor environments where separation of course content is mandatory. The vulnerability requires an active instructor account but does not require knowledge of advanced exploitation techniques, as it relies on predictable or discoverable object identifiers. Mitigation requires updating to the patched version 3.7.46 or later to enforce proper access control checks on server-side retrieval requests.",
  "technicalDetails": "The vulnerability resides within the quiz question management functionality of the MasterStudy LMS plugin. The root cause is an improper authorization check occurring when the application processes requests to fetch quiz question details. Specifically, the plugin fails to validate whether the requester possesses the appropriate ownership or permission over the requested object ID provided in the input parameters.\nThe attack flow begins when an authenticated instructor initiates a request to retrieve quiz question data. The application fails to verify the relationship between the authenticated user and the requested question ID. Because the backend logic lacks a check to ensure the resource belongs to the current user's course scope, it permits the retrieval of any arbitrary question ID passed in the request body or parameters.\nExploitation is straightforward: an attacker identifies the parameter responsible for the quiz question lookup. By iterating through sequential identifiers or using guessed numeric values, the attacker crafts a malicious request targeted at resources owned by other instructors. Upon submission, the server-side component processes the request and returns the serialized response containing the question text, the correct answer, and the pedagogical explanation, effectively bypassing the intended access control boundary.\nThe vulnerable component is the server-side script responsible for processing instructor dashboard requests, specifically the question retrieval function that fails to invoke a permission check against the current session's user ID. This IDOR vulnerability is prevalent in environments where object-level security is omitted in favor of simple parameter mapping.\nThe attack is performed over standard HTTP/HTTPS protocols and does not require complex payloads. The impact is primarily a loss of confidentiality regarding academic assessment data, facilitating potential plagiarism or content theft. Because this check is missing at the application layer, the system treats all instructor-level requests as legitimate as long as the user session is authenticated. Post-exploitation, the attacker has access to the full repository of questions and answers associated with the LMS, which could lead to mass exfiltration of content by automating the enumeration of question IDs."
}