CVE-2024-2106
published 2024-03-13CVE-2024-2106: The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Information Exposure in versions up to, and…
PriorityP344high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.80%
52.0th percentile
The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Information Exposure in versions up to, and including, 3.2.10. This can allow unauthenticated attackers to extract sensitive data including all registered user's username and email addresses which can be used to help perform future attacks.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| stylemix | masterstudy_lms_wordpress_plugin_for_online_courses_and_education | <= 3.2.10 | — |
| stylemixthemes | masterstudy_lms | < 3.2.11 | 3.2.11 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
MasterStudy LMS Plugin up to 3.2.10 on WordPress REST Route information disclosure (ID 3045511)
vuldb·2026-04-13·CVSS 5.3
CVE-2024-2106 [MEDIUM] MasterStudy LMS Plugin up to 3.2.10 on WordPress REST Route information disclosure (ID 3045511)
A vulnerability has been found in MasterStudy LMS Plugin up to 3.2.10 on WordPress and classified as problematic. The affected element is an unknown function of the component REST Route Handler. The manipulation leads to information disclosure.
This vulnerability is referenced as CVE-2024-2106. The attack needs to be initiated within the local network. No exploit is available.
GHSA
GHSA-ggf4-7mhm-hwf4: The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Information Exposure in versions up to,
ghsa_unreviewed·2024-03-13
CVE-2024-2106 [MEDIUM] CWE-200 GHSA-ggf4-7mhm-hwf4: The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Information Exposure in versions up to,
The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Information Exposure in versions up to, and including, 3.2.10. This can allow unauthenticated attackers to extract sensitive data including all registered user's username and email addresses which can be used to help perform future attacks.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://plugins.svn.wordpress.org/masterstudy-lms-learning-management-system/tags/3.2.8/_core/lms/classes/models/StmUser.phphttps://plugins.svn.wordpress.org/masterstudy-lms-learning-management-system/tags/3.2.8/_core/lms/route.phphttps://plugins.trac.wordpress.org/changeset/3045511/masterstudy-lms-learning-management-system/tags/3.2.11/_core/lms/route.php?old=3036794&old_path=masterstudy-lms-learning-management-system/trunk/_core/lms/route.phphttps://www.wordfence.com/threat-intel/vulnerabilities/id/27e4d519-bc98-44d3-a519-72674184e7f2?source=cvehttps://plugins.svn.wordpress.org/masterstudy-lms-learning-management-system/tags/3.2.8/_core/lms/classes/models/StmUser.phphttps://plugins.svn.wordpress.org/masterstudy-lms-learning-management-system/tags/3.2.8/_core/lms/route.phphttps://plugins.trac.wordpress.org/changeset/3045511/masterstudy-lms-learning-management-system/tags/3.2.11/_core/lms/route.php?old=3036794&old_path=masterstudy-lms-learning-management-system/trunk/_core/lms/route.phphttps://www.wordfence.com/threat-intel/vulnerabilities/id/27e4d519-bc98-44d3-a519-72674184e7f2?source=cve
2024-03-13
Published