CyberRota Analysis
AI-GeneratedThe MasterStudy LMS WordPress Plugin prior to version 3.7.46 is vulnerable due to inadequate access controls on a REST route, which permits unauthenticated users to access and enumerate the titles and IDs of unpublished courses. This exposure could lead to information disclosure, potentially revealing sensitive course content before it is officially published. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate the risk of unauthorized information access.
Original NVD Description
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not restrict access to a REST route that lists an author's courses, nor does it filter that listing by publication status, allowing unauthenticated users to read the titles and IDs of unpublished (draft, pending and private) courses.