Subscriber Privilege Escalation in MasterStudy LMS

Executive Summary

This is a Subscriber Privilege Escalation vulnerability in the MasterStudy LMS plugin for WordPress versions 3.7.41 and below. It allows users with low-privilege accounts like Subscriber to escalate their access to higher privileges, potentially gaining full control of the website.

Useful 0 Not Useful 0

Detection Guidance

Check if the MasterStudy LMS plugin version is 3.7.41 or below. Use WordPress admin dashboard or run: wp plugin list --name=masterstudy-lms. If vulnerable, update to version 3.7.42 or later.

Useful 0 Not Useful 0

Impact Analysis

Attackers with low-privilege accounts could exploit this to gain full control of your website. This could lead to unauthorized data access, website defacement, or further attacks on visitors. The CVSS score of 6.3 indicates a significant risk.

Useful 0 Not Useful 0

Mitigation Strategies

Update the MasterStudy LMS plugin to version 3.7.42 or later immediately. If unable to update, apply the mitigation rule provided by Patchstack to block attacks until the update is possible.

Useful 0 Not Useful 0