CERT24GHSA-hp8j-2mhm-c28w: Missing authorization in MasterStudy LMSLoading data…
CERT24Threat Observatory
Period

GHSA-hp8j-2mhm-c28w: Missing authorization in MasterStudy LMS

MasterStudy LMS for WordPress before version 3.7.50 contains a missing authorization vulnerability. Any authenticated user, including Subscribers, can trigger the stm_lms_send_test_email_ajax AJAX action. If display_errors is enabled, the resulting PHP fatal error may disclose the plugin’s absolute filesystem path.

← Back to intelligence

GHSA-hp8j-2mhm-c28w: Missing authorization in MasterStudy LMS

MasterStudy LMS for WordPress before version 3.7.50 contains a missing authorization vulnerability. Any authenticated user, including Subscribers, can trigger the stm_lms_send_test_email_ajax AJAX action. If display_errors is enabled, the resulting PHP fatal error may disclose the plugin’s absolute filesystem path.