CyberRota Analysis
AI-GeneratedThe MasterStudy LMS WordPress Plugin prior to version 3.7.50 is vulnerable due to inadequate ownership and capability checks in its REST API, enabling users with the Instructor role to manipulate any order on the site. This flaw allows unauthorized modifications such as granting free course enrollments and revoking paid enrollments, posing a significant risk to the integrity of course management and user access. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate these risks.
Original NVD Description
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free course enrolment, revoking other users' paid enrolments, and tampering with order notes.