WordPress Plugin Vulnerabilities

MasterStudy LMS < 3.2.13 - Missing Authorization

Description

The MasterStudy LMS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_order and create_order functions in versions up to, and including, 3.2.12. This makes it possible for unauthenticated attackers to create and save orders.

Affects Plugins

Plugin icon
masterstudy-lms-learning-management-system
Fixed in 3.2.13

References

CVE
CVE-2024-37094
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/231f1e11-661d-40e4-a139-0ee2be95d551

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Majed Refaea
Verified
No
WPVDB ID
9a21edbe-2e70-475d-854f-7d445df68902

Timeline

Publicly Published
2024-06-20 (about 2 years ago)
Added
2024-07-02 (about 2 years ago)
Last Updated
2024-07-02 (about 2 years ago)

Other

Published
Title
Published
2026-06-04
Title
wpForo Forum < 3.1.1 - Missing Authorization
Published
2025-11-21
Title
IDonate – Blood Donation, Request And Donor Management System < 2.1.16 - Missing Authorization to Unauthenticated Arbitrary Post Deletion
Published
2026-05-13
Title
Database Backup for WordPress < 2.5.3 - Missing Authorization to Unauthenticated Database Export
Published
2024-05-09
Title
Contact List – Easy Business Directory, Staff Directory and Address Book Plugin < 2.9.88 - Missing Authorization to Notice Dismissal
Published
2026-10-07
Title
Th Shop Mania < 1.9.2 - Missing Authorization