Description
The LMS by Masteriyo WordPress plugin before 1.6.8 does not have proper authorization in one some of its REST API endpoints, making it possible for any students to retrieve email addresses of other students
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | LMS by Masteriyo | < 1.6.8 | 1.6.8 |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- LMS by Masteriyo < 1.6.8 - Information Exposure http/cves/2023/CVE-2023-3345.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- https://wpscan.com/vulnerability/0d07423e-98d2-43a3-824d-562747a3d65a exploit vdb-entry technical-description