Description
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.43 does not validate a redirect parameter supplied during user registration before using it, allowing unauthenticated attackers to redirect users to arbitrary external URLs.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | MasterStudy LMS WordPress Plugin | < 3.7.43 | 3.7.43 |
References
- https://wpscan.com/vulnerability/f6f89b50-3087-4fb6-ba12-93fdc1bcc9ed/ exploit vdb-entry technical-description