CVE-2024-5973 MasterStudy LMS < 3.3.24 - Privilege Escalation to Instructor

2024-07-2206:00:05

WPScan

github.com

cve-2024-5973

masterstudy lms

privilege escalation

wordpress plugin

AI Score

6.7

Confidence

High

SSVC

Exploitation

poc

Automatable

yes

Technical Impact

total

JSON

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.3.24 does not prevent students from creating instructor accounts, which could be used to get access to functionalities they shouldn’t have.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:masterstudy_lms_wordpress_plugin:masterstudy_lms_wordpress_plugin:3.3.24:*:*:*:*:*:*:*"
    ],
    "vendor": "masterstudy_lms_wordpress_plugin",
    "product": "masterstudy_lms_wordpress_plugin",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "3.3.24",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]