Unauthorized Quiz Attempt Data Exposure in MasterStudy LMS WordPress Plugin

Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) flaw in the MasterStudy LMS WordPress plugin before version 3.7.50. It allows any authenticated user with a subscriber role or higher to access quiz attempt results of other students by manipulating an attempt identifier. The plugin fails to verify ownership of the data before returning it, exposing grades, pass/fail status, and attempt timestamps.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your MasterStudy LMS WordPress plugin version is below 3.7.50. Log in as a subscriber and attempt to access quiz attempt results of other users by manipulating attempt identifiers in URLs or API calls. If data from other users is accessible, the vulnerability exists.

Useful 0 Not Useful 0

Impact Analysis

If you use the MasterStudy LMS plugin before version 3.7.50, an attacker with minimal access could view sensitive quiz results of other users. This includes grades, pass/fail status, and timestamps, potentially leading to privacy violations or academic dishonesty if exploited.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate data protection regulations like GDPR or HIPAA by exposing sensitive user data without proper access controls. Unauthorized access to quiz results may constitute a breach of confidentiality requirements under these standards.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the MasterStudy LMS plugin to version 3.7.50 or later. If updating is not possible, restrict user roles to prevent subscribers from accessing sensitive quiz data or disable quiz functionality until patched.

Useful 0 Not Useful 0