PT-2024-18826 · WordPress · Masterstudy Lms Wordpress Plugin

Hiroho Shimada · Published 2024-03-13 · Updated 2025-01-22 · CVE-2024-2106

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress versions up to, and including, 3.2.10

Description The issue allows unauthenticated attackers to extract sensitive data, including all registered users' usernames and email addresses, which can be used to help perform future attacks. This can lead to information exposure.

Recommendations For versions up to, and including, 3.2.10, update to a version higher than 3.2.10 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-2106

Affected Products

Masterstudy Lms Wordpress Plugin

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-2106 · Security Note
• https://osv.dev/vulnerability/CVE-2024-2106 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset/3045511/masterstudy-lms-learning-management-system/tags/3.2.11/_core/lms/route.php?old=3036794&old_path=masterstudy-lms-learning-management-system/trunk/_core/lms/route.php · Patch
• https://twitter.com/CVEnew/status/1767941860188655924 · Twitter Post
• https://plugins.svn.wordpress.org/masterstudy-lms-learning-management-system/tags/3.2.8/_core/lms/route.php · Note
• https://plugins.svn.wordpress.org/masterstudy-lms-learning-management-system/tags/3.2.8/_core/lms/classes/models/StmUser.php · Note
• https://t.me/cvenotify/108274 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/27e4d519-bc98-44d3-a519-72674184e7f2?source=cve · Note