WordPress Plugin Vulnerabilities

Masteriyo - LMS < 1.7.4 - Insecure Direct Object Reference

Description

The Masteriyo LMS – eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.7.3 via the REST API due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view other users course progress.

Affects Plugins

Plugin icon
learning-management-system
Fixed in 1.7.4

References

CVE
CVE-2024-33939
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/0173e2a3-452d-490b-8ed7-a049a476d137

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Steven Julian
Verified
No
WPVDB ID
57c0054a-b713-4f7c-8e41-c009b07624a6

Timeline

Publicly Published
2024-04-30 (about 1 year ago)
Added
2024-05-07 (about 1 year ago)
Last Updated
2024-05-07 (about 1 year ago)

Other

Published
Title
Published
2025-11-12
Title
Timetable and Event Schedule by MotoPress < 2.4.16 - Contributor+ Event Disclosure via IDOR
Published
2025-03-12
Title
Business Directory Plugin - Easy Listing Directories for WordPress < 6.4.15 - Insecure Direct Object Reference to Listing Arbitrary Image Addition
Published
2025-07-16
Title
Maya Business < 1.3.0 - Unauthenticated Insecure Direct Object Reference
Published
2025-05-13
Title
PeepSo Core: File Uploads < 6.4.6.1 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via file_download
Published
2025-05-30
Title
Free Booking Plugin for Hotels, Restaurants and Car Rentals – eaSYNC Booking < 1.3.22 - Insecure Direct Object Reference to Sensitive Information Exposure