CVE-2024-2106: Infoleak
First published: Wed Mar 13 2024(Updated: )
The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Information Exposure in versions up to, and including, 3.2.10. This can allow unauthenticated attackers to extract sensitive data including all registered user's username and email addresses which can be used to help perform future attacks.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| MasterStudy LMS WordPress Plugin | <3.2.11 | |
| MasterStudy LMS | <=3.2.10 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://plugins.svn.wordpress.org/masterstudy-lms-learning-management-system/tags/3.2.8/_core/lms/classes/models/StmUser.php
- https://plugins.svn.wordpress.org/masterstudy-lms-learning-management-system/tags/3.2.8/_core/lms/route.php
- https://plugins.trac.wordpress.org/changeset/3045511/masterstudy-lms-learning-management-system/tags/3.2.11/_core/lms/route.php?old=3036794&old_path=masterstudy-lms-learning-management-system/trunk/_core/lms/route.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/27e4d519-bc98-44d3-a519-72674184e7f2?source=cve
Frequently Asked Questions
What is the severity of CVE-2024-2106?
CVE-2024-2106 has been classified as a medium severity vulnerability due to its potential to expose sensitive user data.
How do I fix CVE-2024-2106?
To remediate CVE-2024-2106, update the MasterStudy LMS WordPress Plugin to version 3.2.11 or later.
What data can be exposed by CVE-2024-2106?
CVE-2024-2106 can allow attackers to extract sensitive information, specifically registered users' usernames and email addresses.
What versions of the MasterStudy LMS Plugin are affected by CVE-2024-2106?
CVE-2024-2106 affects all versions of the MasterStudy LMS WordPress Plugin up to and including version 3.2.10.
Is authentication required to exploit CVE-2024-2106?
No, CVE-2024-2106 allows unauthenticated attackers to exploit the vulnerability.
- agent/author
- agent/references
- agent/type
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/first-publish-date
- agent/source
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/severity
- agent/remedy
- agent/softwarecombine
- agent/event
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup-request
- vendor/stylemixthemes
- canonical/masterstudy lms wordpress plugin
- vendor/masterstudy
- canonical/masterstudy lms