What’s Vulnerable › Vulnerabilities

CVE-2024-3942: MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.3.8 - Missing Authorization

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-05-02 · updated 2026-06-17
• Weakness: CWE-862

Description

The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on several functions in versions up to, and including, 3.3.8. This makes it possible for authenticated attackers, with subscriber level permissions and above, to read and modify content such as course questions, post titles, and taxonomies.

Affected products

• MasterStudy LMS WordPress Plugin: before 3.3.9 — fixed in 3.3.9

How to fix

Upgrade to a fixed version: MasterStudy LMS WordPress Plugin 3.3.9. Check the vendor advisory for mitigations.

References

• https://plugins.trac.wordpress.org/changeset/3078394/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/64eb3d67-7056-4a03-ba3b-a04c2e96648d?source=cve
• https://plugins.trac.wordpress.org/changeset/3078394/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/64eb3d67-7056-4a03-ba3b-a04c2e96648d?source=cve

Get alerted when CVE-2024-3942 or the next vulnerability affects your stack