Subscriber Privilege Escalation in MasterStudy LMS

Executive Summary

This is a Subscriber Privilege Escalation vulnerability in the MasterStudy LMS plugin for WordPress versions 3.7.41 and below. It allows users with low-privilege accounts like Subscriber to escalate their access to higher privileges, potentially gaining full control of the website.

Useful 0 Not Useful 0

Detection Guidance

Check if the MasterStudy LMS plugin version is 3.7.41 or below. Use WordPress admin dashboard or run: wp plugin list --name=masterstudy-lms. If vulnerable, update to version 3.7.42 or later.

Useful 0 Not Useful 0

Impact Analysis

Attackers with low-privilege accounts could exploit this to gain full control of your website. This could lead to unauthorized data access, website defacement, or further attacks on visitors. The CVSS score of 6.3 indicates a significant risk.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR and HIPAA. Unauthorized privilege escalation may result in data breaches, exposing personal or health information and failing to meet regulatory security standards.

Useful 0 Not Useful 0

Mitigation Strategies

Update the MasterStudy LMS plugin to version 3.7.42 or later immediately. If unable to update, apply the mitigation rule provided by Patchstack to block attacks until the update is possible.

Useful 0 Not Useful 0