Authorization Bypass in MasterStudy LMS WordPress Plugin

Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) flaw in the MasterStudy LMS WordPress plugin before version 3.7.46. It allows any authenticated user, including those with low privileges like Subscribers, to access and view order line-item data of other instructors by supplying another user's identifier. This means unauthorized users can read sales records of courses they do not own.

Useful 0 Not Useful 0

Detection Guidance

Check WordPress plugin versions using WP-CLI with: wp plugin list | grep masterstudy-lms. Inspect network traffic for requests to order endpoints with author_id parameters. Review server logs for unauthorized access attempts to /wp-json/ms/v1/orders or similar endpoints.

Useful 0 Not Useful 0

Impact Analysis

If you are a user of the MasterStudy LMS plugin before version 3.7.46, an attacker with even a basic account could exploit this to view sensitive sales data of other instructors. This includes course sales records, which may contain personal or financial information, leading to privacy breaches or data leaks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by exposing personal and sensitive data without authorization. GDPR requires protecting personal data, and HIPAA mandates safeguarding health-related information. A breach could result in legal penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Update the MasterStudy LMS plugin to version 3.7.46 or later immediately. Temporarily restrict Subscriber roles from accessing sensitive endpoints via server rules or plugin configurations until updated.

Useful 0 Not Useful 0