MasterStudy LMS WordPress Plugin Missing Authorization Vulnerability Allowing Unauthorized Data Modification and Deletion

A vulnerability exists in the MasterStudy LMS WordPress Plugin for Online Courses and Education, affecting all versions through 3.7.6. The issue arises from inadequate capability checks on several REST API endpoints, allowing authenticated attackers with Subscriber-level access or higher to improperly modify or delete data. This vulnerability enables the upload or deletion of arbitrary media files, unauthorized changes to posts, and the creation or management of course templates.

Impact

Exploitation of this vulnerability could lead to unauthorized modification and deletion of data, including media files, posts, and course templates.

Remediation

Users are advised to update the MasterStudy LMS WordPress Plugin to version 3.7.7 or a newer patched version.