Description

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning a student's learning statistics, allowing unauthenticated attackers to disclose the course counts, points, certificates, quiz and assignment totals of any registered user.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-02T06:17:19.077Z",
  "pubdate": "2026-09-02T06:17:19.077Z",
  "executiveSummary": "The MasterStudy LMS WordPress plugin before version 3.7.46 is susceptible to an unauthenticated Information Disclosure vulnerability. This security flaw stems from a lack of proper authorization checks on API endpoints responsible for retrieving student learning metrics.\nThe vulnerability allows remote, unauthenticated attackers to access sensitive academic data belonging to any registered user on the WordPress installation. Affected data points include course enrollment counts, accumulated points, certification status, and granular progress statistics for quizzes and assignments.\nThe risk implication is significant as it facilitates unauthorized reconnaissance, potentially exposing personally identifiable learning progress and academic performance metrics without requiring valid credentials. Because the endpoint does not validate the requestor's session or permissions, an attacker can iterate through user IDs or other identifiers to harvest data at scale, compromising user privacy and potentially mapping the internal activity of the learning management system.\nExploitation requires no special privileges or pre-existing account access, making it a low-complexity attack vector that can be executed via standard web requests directed at the vulnerable plugin's API or callback functions.",
  "technicalDetails": "The root cause of this vulnerability is an insecure implementation of data-retrieval functions within the MasterStudy LMS plugin. Specifically, the plugin components responsible for serving student statistics fail to implement adequate access control checks, such as those provided by WordPress functions like current_user_can() or appropriate nonce verification.\nThe vulnerability manifests in the plugin's handling of requests intended to fetch student-specific learning metrics. In the vulnerable versions prior to 3.7.46, these functions rely on user-supplied parameters to identify the target user without confirming that the requesting entity has the authority to view the requested data. Because these endpoints are exposed to the public-facing side of the application, they are reachable by any remote actor.\nThe attack flow begins with the reconnaissance of the plugin's API architecture. An attacker identifies the specific request structure used to query learning statistics—typically a GET or POST request targeting a specific plugin-registered endpoint. By manipulating identifiers within the request (such as user IDs or database keys), the attacker crafts a request that the server processes as a legitimate query.\nBecause the server-side code does not perform an authorization handshake, it executes the query against the database, fetches the requested statistics, and returns them in the response body—often formatted as JSON or serialized data. This process happens entirely without session verification.\nThe impact of this behavior is a direct, unauthorized information disclosure. By automating these requests, an attacker can systematically scrape sensitive data across the user base. This information includes course progress, total points, certificate attainment, and assignment completion statuses. Beyond the privacy violation, this information could be used for further social engineering or to map the demographics and behavior of the platform's user base.\nThe vulnerable component is the API or callback handler responsible for returning user statistics. This is a logic-level vulnerability that bypasses standard WordPress permission models, necessitating that all future requests to these functions be wrapped in strict authorization gates that verify the ownership of the data being requested or administrative-level privileges before proceeding with the database query execution."
}