MasterStudy LMS WordPress Plugin – for Online Courses and Education

Software Type	Plugin
Software Slug	masterstudy-lms-learning-management-system (view on wordpress.org)
Software Status	Active
Software Author	stylemix
Software Website	masterstudy.stylemixthemes.com
Software Downloads	1,328,439
Software Active Installs	10,000
Software Record Last Updated	December 22, 2024

16 Vulnerabilities

Submit a Vulnerability

MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.3.23 - Unauthenticated Limited Privilege Escalation to Instructor

7.3

CVE-2024-5973

Jul 1, 2024

Researcher: Jaime F. Murillo

MasterStudy LMS <= 3.2.12 - Missing Authorization

5.3

CVE-2024-37094

Jun 20, 2024

Researcher: Majed Refaea

MasterStudy LMS <= 3.2.1 - Cross-Site Request Forgery

4.3

CVE-2024-37093

Jun 20, 2024

Researcher: Majed Refaea

MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.3.8 - Missing Authorization

6.3

CVE-2024-3942

Apr 29, 2024

Researcher: Lucio Sá

MasterStudy LMS <= 3.3.3 - Unauthenticated Local File Inclusion via template

9.8

CVE-2024-3136

Apr 4, 2024

Researcher: Hiroho Shimada

MasterStudy LMS <= 3.3.1 - Unauthenticated Privilege Escalation via stm_lms_register AJAX Action

9.8

CVE-2024-2409

Mar 28, 2024

Researcher: Hiroho Shimada

MasterStudy LMS <= 3.3.0 - Unauthenticated Local File Inclusion via modal

9.8

CVE-2024-2411

Mar 28, 2024

Researcher: Hiroho Shimada

MasterStudy LMS <= 3.2.13 - Missing Authorization to Sensitive Information Exposure in search_posts

4.3

CVE-2024-1904

Mar 15, 2024

Researcher: Krzysztof Zając

MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.10 - Basic Information Exposure via REST route

5.3

CVE-2024-2106

Mar 6, 2024

Researcher: Hiroho Shimada

MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.5 - Unauthenticated SQL Injection

9.8

CVE-2024-1512

Feb 16, 2024

Researcher: Krzysztof Zając

MasterStudy LMS <= 3.0.17 - Privilege Escalation

7.3

CVE-2023-4278

Aug 21, 2023

Researcher: Revan Arifio

Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get

6.1

CVE-2023-33999

Jul 18, 2023

Researcher: Rafie Muhammad

MasterStudy LMS <= 3.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2023-35090

Jun 15, 2023

Researcher: Rafshanzani Suhada

MasterStudy LMS <= 3.0.8 - Missing Authorization to Course Category Creation

4.3

CVE-2023-35093

Jun 15, 2023

Researcher: Rafshanzani Suhada

MasterStudy LMS WordPress Plugin <= 2.9.34 - Missing Authorization via wp_ajax_stm_wpcfto_get_settings

4.3

CVE ID Unknown

Apr 3, 2023

Researchers:

MasterStudy LMS < 2.7.6 - Unauthenticated Admin Account Creation

9.8

CVE-2022-0441

Feb 1, 2022

Researcher: Numan Türle

Title	Status	CVE ID	CVSS	Researchers	Date
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.3.23 - Unauthenticated Limited Privilege Escalation to Instructor	Patched	CVE-2024-5973	7.3	Jaime F. Murillo	July 1, 2024
MasterStudy LMS <= 3.2.12 - Missing Authorization	Patched	CVE-2024-37094	5.3	Majed Refaea	June 20, 2024
MasterStudy LMS <= 3.2.1 - Cross-Site Request Forgery	Patched	CVE-2024-37093	4.3	Majed Refaea	June 20, 2024
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.3.8 - Missing Authorization	Patched	CVE-2024-3942	6.3	Lucio Sá	April 29, 2024
MasterStudy LMS <= 3.3.3 - Unauthenticated Local File Inclusion via template	Patched	CVE-2024-3136	9.8	Hiroho Shimada	April 4, 2024
MasterStudy LMS <= 3.3.1 - Unauthenticated Privilege Escalation via stm_lms_register AJAX Action	Patched	CVE-2024-2409	9.8	Hiroho Shimada	March 28, 2024
MasterStudy LMS <= 3.3.0 - Unauthenticated Local File Inclusion via modal	Patched	CVE-2024-2411	9.8	Hiroho Shimada	March 28, 2024
MasterStudy LMS <= 3.2.13 - Missing Authorization to Sensitive Information Exposure in search_posts	Patched	CVE-2024-1904	4.3	Krzysztof Zając	March 15, 2024
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.10 - Basic Information Exposure via REST route	Patched	CVE-2024-2106	5.3	Hiroho Shimada	March 6, 2024
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.5 - Unauthenticated SQL Injection	Patched	CVE-2024-1512	9.8	Krzysztof Zając	February 16, 2024
MasterStudy LMS <= 3.0.17 - Privilege Escalation	Patched	CVE-2023-4278	7.3	Revan Arifio	August 21, 2023
Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get	Patched	CVE-2023-33999	6.1	Rafie Muhammad	July 18, 2023
MasterStudy LMS <= 3.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting	Patched	CVE-2023-35090	6.4	Rafshanzani Suhada	June 15, 2023
MasterStudy LMS <= 3.0.8 - Missing Authorization to Course Category Creation	Patched	CVE-2023-35093	4.3	Rafshanzani Suhada	June 15, 2023
MasterStudy LMS WordPress Plugin <= 2.9.34 - Missing Authorization via wp_ajax_stm_wpcfto_get_settings	Patched		4.3		April 3, 2023
MasterStudy LMS < 2.7.6 - Unauthenticated Admin Account Creation	Patched	CVE-2022-0441	9.8	Numan Türle	February 1, 2022

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation