Unauthenticated Information Disclosure in MasterStudy LMS WordPress Plugin

Executive Summary

This vulnerability affects the MasterStudy LMS WordPress plugin before version 3.7.46. It allows unauthenticated attackers to access and disclose sensitive learning statistics of any registered user, including course counts, points, certificates, quiz totals, and assignment totals. This happens because the plugin does not perform an authorization check in the student/stats REST route.

Useful 0 Not Useful 0

Detection Guidance

Check if your MasterStudy LMS plugin version is below 3.7.46. Use WordPress admin panel or run a command like 'wp plugin list' if using WP-CLI to verify the installed version. Test unauthenticated access to the '/wp-json/student/stats' REST endpoint for any user ID to see if it returns sensitive data.

Useful 0 Not Useful 0

Impact Analysis

Attackers could exploit this to view private learning data of any user on a vulnerable site. This includes personal progress, achievements, and performance metrics, potentially leading to privacy violations or misuse of sensitive information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to personal and sensitive user data. Organizations may face legal penalties, reputational damage, and loss of trust if such data breaches occur.

Useful 0 Not Useful 0

Mitigation Strategies

Update the MasterStudy LMS plugin to version 3.7.46 or later immediately. If an update is not available, consider disabling the plugin temporarily until a patch is released. Review server logs for suspicious requests to the '/student/stats' endpoint.

Useful 0 Not Useful 0