CVE-2023-3345

CVE-2023-3345 affects the LMS by Masteriyo WordPress plugin prior to 1.6.8. The plugin’s REST API endpoints lack proper authorization, enabling any student to retrieve other students’ email addresses (information disclosure). Root cause per connected details: insufficient access checks on REST ro...

CVE-2024-24882

The Masteriyo LMS (learning-management-system) plugin for WordPress is vulnerable to unauthenticated privilege escalation in versions up to and including 1.7.2 . The root cause is a missing capability check on the update_logged_in_user() function within the UsersController.php file. Specifically,...

CVE-2024-33939

The Masteriyo - LMS WordPress plugin (versions