Description

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform a per-object ownership check when returning a quiz attempt result, allowing any authenticated user with a minimal (subscriber) role to read other students' quiz grades, pass/fail status and attempt timestamps by referencing an attempt identifier belonging to another user.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-23T06:17:02.263Z",
  "pubdate": "2026-09-23T06:17:02.263Z",
  "executiveSummary": "The MasterStudy LMS WordPress plugin before version 3.7.50 is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability.\nThis vulnerability exists due to a missing authorization check when retrieving quiz attempt results. By manipulating the attempt identifier in a request, an authenticated user can access sensitive educational data belonging to other students.\nThe impact includes the unauthorized disclosure of private information, such as quiz grades, pass/fail status, and completion timestamps.\nThe vulnerability affects all versions of the plugin prior to 3.7.50. Exploitation requires minimal privileges, such as a subscriber-level WordPress account, and does not require elevated access or specific user interaction beyond knowing or guessing a valid attempt ID.\nThis flaw presents a significant risk to data privacy and regulatory compliance within educational environments utilizing the plugin, as it allows any authenticated attacker to perform unauthorized data harvesting across the user base.",
  "technicalDetails": "The root cause of this vulnerability is a failure to implement per-object ownership validation within the quiz result retrieval functionality of the MasterStudy LMS plugin.\nThe application relies on a predictable or discoverable attempt identifier to fetch result data but neglects to verify whether the currently authenticated user is the legitimate owner of the resource being requested.\nBecause the server-side code does not perform an authorization check against the database record associated with the request parameter, it trusts the provided identifier implicitly.\nThe exploitation process follows a standard IDOR pattern: an attacker with a subscriber account authenticates to the WordPress instance. The attacker then intercepts or constructs a request to the plugin's API or endpoint responsible for fetching quiz attempt results. By systematically incrementing or iterating through numerical attempt identifiers, the attacker can successfully bypass access controls and receive JSON or HTML responses containing the quiz data of other users.\nThe attack is characterized by its simplicity and low barrier to entry. Since the vulnerability is located in the data-fetching logic, the exploitation is performed via standard HTTP GET or POST requests depending on the plugin's API architecture.\nThe post-exploitation impact allows for mass data scraping of student performance records. This could lead to a breach of sensitive information, potentially violating privacy regulations such as GDPR or FERPA, depending on the scope of the institution. There is no requirement for administrative privileges, making the entire user base of the WordPress site a potential target for any attacker with basic 'subscriber' level access. The lack of adequate server-side session-to-resource mapping renders the current implementation insufficient for multi-user environments where data isolation is critical."
}