MasterStudy LMS Plugin Instructor Role Order Data Exposure

Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) flaw in the MasterStudy LMS WordPress plugin versions before 3.7.42. It allows users with the instructor role to access and disclose other users' order billing details, including names, email addresses, phone numbers, and postal addresses, by enumerating order IDs.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if users with the instructor role can access order details of other users by enumerating order IDs. Use WordPress admin access to verify if billing information is exposed when accessing order endpoints with different IDs.

Useful 0 Not Useful 0

Impact Analysis

If you are a user with the instructor role on a site using the vulnerable plugin, you could access sensitive billing information of other users. If you are an administrator, your users' personal and financial data could be exposed, leading to privacy violations and potential misuse of data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to personal and sensitive data. GDPR requires protection of personal data, and HIPAA mandates safeguarding protected health information. A breach could result in legal penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the MasterStudy LMS WordPress plugin to version 3.7.42 or later. Review user roles and permissions to ensure instructors cannot access sensitive order information. Monitor for unauthorized access attempts to order data.

Useful 0 Not Useful 0