by Kastro
Paper/Archive/CVE-2024-5973

CVE-2024-5973

Unknown MasterStudy LMS WordPress Plugin — MasterStudy LMS < 3.3.24 - Privilege Escalation to Instructor

EPSS 0.5%public exploitCVSS 9.1
critical.is priorityof 100
46
CVSS 9.1 (ADP)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 42.4.424 × 208.5Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.3.24 does not prevent students from creating instructor accounts, which could be used to get access to functionalities they shouldn't have.

Affected

ProductAffectedFixed inSource
MasterStudy LMS WordPress Plugin< 3.3.243.3.24CNA
masterstudy_lms_wordpress_plugin< 3.3.243.3.24CISA-ADP

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitwpscan.com/vulnerability/59abfb7c-d5ea-45f2-ab9a-4391978e3805