Medium · 6.5 CVE-2023-35093 EUVD-2023-39127GHSA-v8c9-2pwj-6494

WordPress MasterStudy LMS Plugin <= 3.0.8 is vulnerable to Broken Access Control

Published Jun 22, 2023 · Updated Apr 28, 2026 · Assigned by Patchstack

Vendor: StylemixThemes Product: MasterStudy LMS WordPress Plugin – for Online Courses and Education Category: Web / CMS

Description

Broken Access Control vulnerability in StylemixThemes MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin <= 3.0.8 versions allows any logged-in users, such as subscribers to view the "Orders" of the plugin and get the data related to the order like email, username, and more.

Affected products

Vendor	Product	Affected	Fixed
StylemixThemes	MasterStudy LMS WordPress Plugin – for Online Courses and Education	≤ 3.0.8	—

References

https://patchstack.com/database/vulnerability/masterstudy-lms-learning-management-system/wordpress-masterstudy-lms-plugin-3-0-7-broken-access-control-vulnerability?_s_id=cve vdb-entry