CVE-2023-35093
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
The MasterStudy LMS plugin for WordPress versions <= 3.0.8 has a broken access control vulnerability that allows logged-in users, such as subscribers, to view the plugin's orders and obtain order-related data like email, username, and more.
Risk Assessment
This vulnerability may lead to unauthorized access to sensitive user data, posing a risk to privacy and data security within the organization.
Recommendation
It is recommended to update the MasterStudy LMS plugin to the latest version to mitigate this vulnerability and review the access policy for data within the system.
Original NVD description (English source)
Broken Access Control vulnerability in StylemixThemes MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin <= 3.0.8 versions allows any logged-in users, such as subscribers to view the "Orders" of the plugin and get the data related to the order like email, username, and more.