MasterStudy LMS WordPress Plugin – for Online Courses and Education vulnerabilities

5 known vulnerabilities in MasterStudy LMS WordPress Plugin – for Online Courses and Education from Stylemix. 5 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  MasterStudy LMS WordPress Plugin – for Online…: Improper Control of Filename for Include/Require Statement in PHP Program

  CVE-2024-3136Apr 9, 2024StylemixEPSS 5.02%

  The MasterStudy LMS plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.3 via the 'template' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server,

• 9.8 Critical severity

  MasterStudy LMS WordPress Plugin – for Online…: Improper Control of Filename for Include/Require Statement in PHP Program

  CVE-2024-2411Mar 29, 2024StylemixEPSS 1.54%

  The MasterStudy LMS plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.0 via the 'modal' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, all

• 9.8 Critical severity

  MasterStudy LMS WordPress Plugin – for Online…: Incorrect Privilege Assignment

  CVE-2024-2409Mar 29, 2024Stylemix

  The MasterStudy LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.1. This is due to insufficient validation checks within the _register_user() function called by the 'wp_ajax_nopriv_stm_lms_register' AJAX

• 7.5 High severity

  MasterStudy LMS WordPress Plugin – for Online…: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2024-2106Mar 13, 2024Stylemix

  The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Information Exposure in versions up to, and including, 3.2.10. This can allow unauthenticated attackers to extract sensitive data including all regist

• 9.8 Critical severity

  MasterStudy LMS WordPress Plugin – for Online…: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2024-1512Feb 17, 2024StylemixEPSS 77.7%

  The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to union based SQL Injection via the 'user' parameter of the /lms/stm-lms/order/items REST route in all versions up to, and including, 3.2.5 due to insuf