MasterStudy LMS vulnerabilities
7 known vulnerabilities in MasterStudy LMS from StylemixThemes. 7 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.8 Critical severity
MasterStudy LMS: Missing Authorization
Missing Authorization vulnerability in StylemixThemes MasterStudy LMS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MasterStudy LMS: from n/a through 3.2.12.
- 9.8 Critical severity
MasterStudy LMS WordPress Plugin – for Online…: Improper Control of Filename for Include/Require Statement in PHP Program
The MasterStudy LMS plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.3 via the 'template' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server,
- 9.8 Critical severity
MasterStudy LMS WordPress Plugin – for Online…: Improper Control of Filename for Include/Require Statement in PHP Program
The MasterStudy LMS plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.0 via the 'modal' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, all
- 9.8 Critical severity
MasterStudy LMS WordPress Plugin – for Online…: Incorrect Privilege Assignment
The MasterStudy LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.1. This is due to insufficient validation checks within the _register_user() function called by the 'wp_ajax_nopriv_stm_lms_register' AJAX
- 7.5 High severity
MasterStudy LMS WordPress Plugin – for Online…: Exposure of Sensitive Information to an Unauthorized Actor
The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Information Exposure in versions up to, and including, 3.2.10. This can allow unauthenticated attackers to extract sensitive data including all regist
- 9.8 Critical severity
MasterStudy LMS WordPress Plugin – for Online…: Improper Neutralization of Special Elements used in an SQL Command
The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to union based SQL Injection via the 'user' parameter of the /lms/stm-lms/order/items REST route in all versions up to, and including, 3.2.5 due to insuf
- 9.8 Critical severity
MasterStudy LMS – WordPress LMS Plugin: Improper Privilege Management
The MasterStudy LMS WordPress plugin before 2.7.6 does to validate some parameters given when registering a new account, allowing unauthenticated users to register as an admin