WordPress MasterStudy LMS Plugin <= 3.0.8 is vulnerable to Broken Access Control

Vulnerability

The MasterStudy LMS WordPress Plugin versions prior to and including 3.0.8 contain a broken access control vulnerability in the order management functionality. The plugin fails to properly enforce authorization checks, allowing any authenticated user (including subscribers) to access the "Orders" endpoint and retrieve sensitive order data belonging to other users [1].

Exploitation

An attacker only needs to be logged into the WordPress site as any user (e.g., a subscriber account) and navigate to the plugin's orders interface or directly call the associated REST endpoint. No elevated privileges are required, and no user interaction from the victim is needed [1].

Impact

Successful exploitation leads to unauthorized disclosure of sensitive information, including the email address and username of users associated with orders, as well as other order-related metadata. This information leakage can facilitate further targeted attacks, such as phishing or credential stuffing [1].

Mitigation

The vulnerability is fixed in version 3.0.9 and later. Users are strongly advised to update to the latest version (3.7.32 as of the reference date) immediately. No workaround is provided for versions prior to 3.0.8 [1].