MasterStudy LMS WordPress Plugin – for Online Courses and Education < 3.7.42 - Authenticated (Subscriber+) Privilege Escalation

Description

The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.7.41. This is due to insufficient restriction on the capabilities a user may grant themselves. This makes it possible for authenticated attackers, with subscriber-level access and above, to elevate their privileges beyond those intended for their role.