What’s Vulnerable › Vulnerabilities

CVE-2023-3345: LMS by Masteriyo < 1.6.8 - Information Exposure

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-07-31 · updated 2026-06-17

Description

The LMS by Masteriyo WordPress plugin before 1.6.8 does not have proper authorization in one some of its REST API endpoints, making it possible for any students to retrieve email addresses of other students

Affected products

• LMS by Masteriyo: before 1.6.8 — fixed in 1.6.8

How to fix

Upgrade to a fixed version: LMS by Masteriyo 1.6.8. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/0d07423e-98d2-43a3-824d-562747a3d65a
• https://wpscan.com/vulnerability/0d07423e-98d2-43a3-824d-562747a3d65a

Get alerted when CVE-2023-3345 or the next vulnerability affects your stack