CVE-2024-5973
MasterStudy LMS < 3.3.24 - Privilege Escalation to Instructor
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.3.24 does not prevent students from creating instructor accounts, which could be used to get access to functionalities they shouldn't have.
El complemento de WordPress MasterStudy LMS WordPress Plugin anterior a 3.3.24 no impide que los estudiantes creen cuentas de instructor, que podrían usarse para obtener acceso a funcionalidades que no deberían tener.
The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and including, 3.3.23. This is due to insufficient role restrictions when registering through the stm_lms_register AJAX endpoint. This makes it possible for unauthenticated attackers to register on sites with Instructor level access.
CVSS Scores
SSVC
- Decision:Attend
Timeline
- 2024-06-13 CVE Reserved
- 2024-07-01 CVE Published
- 2024-07-26 EPSS Updated
- 2024-08-01 First Exploit
- 2024-08-09 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-269: Improper Privilege Management
CAPEC
References (1)
URL | Tag | Source |
---|
URL | Date | SRC |
---|---|---|
https://wpscan.com/vulnerability/59abfb7c-d5ea-45f2-ab9a-4391978e3805 | 2024-08-01 |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Stylemixthemes Search vendor "Stylemixthemes" | Masterstudy Lms Search vendor "Stylemixthemes" for product "Masterstudy Lms" | < 3.3.24 Search vendor "Stylemixthemes" for product "Masterstudy Lms" and version " < 3.3.24" | wordpress |
Affected
|