CVE Catalog
CVE-2023-3345
MediumCVSS 6.5Exploitation Probability (EPSS)
High risk1.93%
77th percentile - higher than 77% of all known CVEs
Summary
The LMS by Masteriyo WordPress plugin before version 1.6.8 lacks proper authorization in some of its REST API endpoints, allowing students to access the email addresses of other students.
Risk Assessment
The lack of proper authorization may lead to breaches of student personal data privacy, posing a risk to the organization regarding data protection.
Recommendation
It is recommended to update the LMS by Masteriyo plugin to version 1.6.8 or later to ensure proper authorization in REST API endpoints.
Original NVD description (English source)
The LMS by Masteriyo WordPress plugin before 1.6.8 does not have proper authorization in one some of its REST API endpoints, making it possible for any students to retrieve email addresses of other students