Description

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not restrict access to a REST route that lists an author's courses, nor does it filter that listing by publication status, allowing unauthenticated users to read the titles and IDs of unpublished (draft, pending and private) courses.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-02T06:17:18.873Z",
  "pubdate": "2026-09-02T06:17:18.873Z",
  "executiveSummary": "The MasterStudy LMS WordPress plugin is vulnerable to an information disclosure flaw due to improper access control within its REST API implementation.\nThis vulnerability exists because the plugin fails to enforce authentication or authorization checks on specific REST routes designed to retrieve course listings.\nFurthermore, the backend logic fails to filter these results based on the course's publication status, exposing metadata for content that should be restricted.\nAn unauthenticated, remote attacker can exploit this flaw by sending a crafted HTTP request to the vulnerable endpoint to enumerate sensitive information.\nThe impact includes the unauthorized exposure of titles and internal IDs for draft, pending, or private courses, which can lead to the leakage of proprietary intellectual property, strategic planning details, or sensitive course structures.\nThe vulnerability affects all versions of the MasterStudy LMS plugin prior to 3.7.46. Given the lack of required authentication, this vulnerability presents a significant risk to site confidentiality, as any network-adjacent attacker can perform reconnaissance on private course content without prior system access.",
  "technicalDetails": "The root cause of this vulnerability lies in an insecure REST API controller implementation within the MasterStudy LMS plugin. Specifically, the plugin exposes an endpoint intended for course retrieval that does not implement the necessary permission callbacks (e.g., 'permission_callback' in the register_rest_route function) to verify the identity or privilege level of the requesting user.\nIn a secure WordPress REST API implementation, developers must ensure that any sensitive data retrieval is gated by a callback function that verifies if the current user possesses 'edit_posts' or other administrative capabilities before processing the query. In this instance, the absence of this verification allows any arbitrary user to invoke the endpoint.\nThe exploitation flow begins with an attacker identifying the specific REST route responsible for listing an author's courses. Once identified, the attacker crafts a GET request targeting this endpoint. Because the application fails to validate the requester's session or role, the server processes the request as a legitimate query.\nThe backend query logic further exacerbates the vulnerability by neglecting to apply the 'post_status' filter. In standard WordPress development, queries targeting posts must explicitly define the status (e.g., 'publish') to prevent the retrieval of non-public content. Because this filtering logic is omitted, the underlying database query returns all post objects associated with an author, regardless of whether they are set to 'draft', 'pending', or 'private'.\nThe API subsequently serializes this unfiltered data—including internal course IDs and titles—into a JSON response and returns it to the unauthenticated attacker. This allows for automated reconnaissance where an attacker can systematically crawl the plugin's REST API to map out future content or identify private course topics that the administrator intended to keep confidential until formal publication.\nThis vulnerability is strictly a software-side access control failure. There is no requirement for user interaction or special privileges; the attack vector is purely network-based and leverages the plugin's native API structure. Post-exploitation, an attacker gains visibility into the editorial pipeline of the LMS, facilitating further targeted attacks or intellectual property theft."
}