Executive brief
MasterStudy LMS is a WordPress plugin that manages online learning courses. An unauthenticated attacker can access a public REST API endpoint to discover the titles and IDs of unpublished courses (drafts, pending, and private), which should only be visible to authorized administrators or instructors. This could expose confidential course information and assist attackers in enumerating system users.
Technical details
The plugin fails to implement authentication checks or publication status filtering on the /wp-json/lms/stm-lms-user/course-list REST endpoint. An unauthenticated attacker can make HTTP GET requests with an author_id parameter to retrieve all courses by that user, bypassing the front-end access controls that hide unpublished content. The vulnerability allows enumeration of both course metadata and user IDs across the WordPress installation. This is a sensitive data exposure flaw (CWE-200) accessible over the network without authentication. The issue is resolved in version 3.7.46.
Affected products
- MasterStudy MasterStudy LMS before 3.7.46
Timeline
- 2026-08-31: disclosed
- 2026-09-02: patched: Version 3.7.46 fixes the vulnerability