CVE-2024-2409 (GCVE-0-2024-2409)

Vulnerability from cvelistv5 – Published: 2024-03-29 08:31 – Updated: 2026-04-08 17:09
VLAI?
Title
MasterStudy LMS <= 3.3.1 - Unauthenticated Privilege Escalation via stm_lms_register AJAX Action
Summary
The MasterStudy LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.1. This is due to insufficient validation checks within the _register_user() function called by the 'wp_ajax_nopriv_stm_lms_register' AJAX action. This makes it possible for unauthenticated attackers to register a user with administrator-level privileges when MasterStudy LMS Pro is installed and the LMS Forms Editor add-on is enabled.
Severity ?
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-266 - Incorrect Privilege Assignment
Assigner
References
Impacted products
Vendor Product Version
stylemix MasterStudy LMS WordPress Plugin – for Online Courses and Education Affected: 0 , ≤ 3.3.1 (semver)
Create a notification for this product.
Credits
Hiroho Shimada
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T19:11:53.476Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/94736152-b365-4b3a-a786-ed49f7d0fc7a?source=cve"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://docs.stylemixthemes.com/masterstudy-lms/changelog-free-version#id-3.3.2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/changeset/3059676/masterstudy-lms-learning-management-system"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:stylemixthemes:masterstudy_lms:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "masterstudy_lms",
            "vendor": "stylemixthemes",
            "versions": [
              {
                "lessThan": "3.3.2",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-2409",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-08T18:33:47.419360Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-08T18:34:51.364Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "MasterStudy LMS WordPress Plugin \u2013 for Online Courses and Education",
          "vendor": "stylemix",
          "versions": [
            {
              "lessThanOrEqual": "3.3.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Hiroho Shimada"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The MasterStudy LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.1. This is due to insufficient validation checks within the _register_user() function called by the \u0027wp_ajax_nopriv_stm_lms_register\u0027 AJAX action. This makes it possible for unauthenticated attackers to register a user with administrator-level privileges when MasterStudy LMS Pro is installed and the LMS Forms Editor add-on is enabled."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-266",
              "description": "CWE-266 Incorrect Privilege Assignment",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T17:09:52.197Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/94736152-b365-4b3a-a786-ed49f7d0fc7a?source=cve"
        },
        {
          "url": "https://docs.stylemixthemes.com/masterstudy-lms/changelog-free-version#id-3.3.2"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3059676/masterstudy-lms-learning-management-system"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-03-13T00:00:00.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2024-03-28T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "MasterStudy LMS \u003c= 3.3.1 - Unauthenticated Privilege Escalation via stm_lms_register AJAX Action"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2024-2409",
    "datePublished": "2024-03-29T08:31:29.816Z",
    "dateReserved": "2024-03-12T21:35:10.961Z",
    "dateUpdated": "2026-04-08T17:09:52.197Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"The MasterStudy LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.1. This is due to insufficient validation checks within the _register_user() function called by the \u0027wp_ajax_nopriv_stm_lms_register\u0027 AJAX action. This makes it possible for unauthenticated attackers to register a user with administrator-level privileges when MasterStudy LMS Pro is installed and the LMS Forms Editor add-on is enabled.\"}, {\"lang\": \"es\", \"value\": \"El complemento MasterStudy LMS para WordPress es vulnerable a la escalada de privilegios en todas las versiones hasta la 3.3.1 incluida. Esto se debe a comprobaciones de validaci\\u00f3n insuficientes dentro de la funci\\u00f3n _register_user() llamada por la acci\\u00f3n AJAX \u0027wp_ajax_nopriv_stm_lms_register\u0027. Esto hace posible que atacantes no autenticados registren un usuario con privilegios de nivel de administrador cuando MasterStudy LMS Pro est\\u00e1 instalado y el complemento LMS Forms Editor est\\u00e1 habilitado.\"}]",
      "id": "CVE-2024-2409",
      "lastModified": "2024-11-21T09:09:41.593",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security@wordfence.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.9}]}",
      "published": "2024-03-29T09:15:07.733",
      "references": "[{\"url\": \"https://docs.stylemixthemes.com/masterstudy-lms/changelog-free-version#id-3.3.2\", \"source\": \"security@wordfence.com\"}, {\"url\": \"https://plugins.trac.wordpress.org/changeset/3059676/masterstudy-lms-learning-management-system\", \"source\": \"security@wordfence.com\"}, {\"url\": \"https://www.wordfence.com/threat-intel/vulnerabilities/id/94736152-b365-4b3a-a786-ed49f7d0fc7a?source=cve\", \"source\": \"security@wordfence.com\"}, {\"url\": \"https://docs.stylemixthemes.com/masterstudy-lms/changelog-free-version#id-3.3.2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://plugins.trac.wordpress.org/changeset/3059676/masterstudy-lms-learning-management-system\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://www.wordfence.com/threat-intel/vulnerabilities/id/94736152-b365-4b3a-a786-ed49f7d0fc7a?source=cve\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "security@wordfence.com",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-2409\",\"sourceIdentifier\":\"security@wordfence.com\",\"published\":\"2024-03-29T09:15:07.733\",\"lastModified\":\"2026-04-08T18:21:05.583\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The MasterStudy LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.1. This is due to insufficient validation checks within the _register_user() function called by the \u0027wp_ajax_nopriv_stm_lms_register\u0027 AJAX action. This makes it possible for unauthenticated attackers to register a user with administrator-level privileges when MasterStudy LMS Pro is installed and the LMS Forms Editor add-on is enabled.\"},{\"lang\":\"es\",\"value\":\"El complemento MasterStudy LMS para WordPress es vulnerable a la escalada de privilegios en todas las versiones hasta la 3.3.1 incluida. Esto se debe a comprobaciones de validaci\u00f3n insuficientes dentro de la funci\u00f3n _register_user() llamada por la acci\u00f3n AJAX \u0027wp_ajax_nopriv_stm_lms_register\u0027. Esto hace posible que atacantes no autenticados registren un usuario con privilegios de nivel de administrador cuando MasterStudy LMS Pro est\u00e1 instalado y el complemento LMS Forms Editor est\u00e1 habilitado.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@wordfence.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"security@wordfence.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-266\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:stylemixthemes:masterstudy_lms:*:*:*:*:*:wordpress:*:*\",\"versionEndExcluding\":\"3.3.2\",\"matchCriteriaId\":\"475BCFD5-F33A-4EE6-85EC-42B03D2A0431\"}]}]}],\"references\":[{\"url\":\"https://docs.stylemixthemes.com/masterstudy-lms/changelog-free-version#id-3.3.2\",\"source\":\"security@wordfence.com\",\"tags\":[\"Patch\",\"Release Notes\"]},{\"url\":\"https://plugins.trac.wordpress.org/changeset/3059676/masterstudy-lms-learning-management-system\",\"source\":\"security@wordfence.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://www.wordfence.com/threat-intel/vulnerabilities/id/94736152-b365-4b3a-a786-ed49f7d0fc7a?source=cve\",\"source\":\"security@wordfence.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://docs.stylemixthemes.com/masterstudy-lms/changelog-free-version#id-3.3.2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Release Notes\"]},{\"url\":\"https://plugins.trac.wordpress.org/changeset/3059676/masterstudy-lms-learning-management-system\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://www.wordfence.com/threat-intel/vulnerabilities/id/94736152-b365-4b3a-a786-ed49f7d0fc7a?source=cve\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://www.wordfence.com/threat-intel/vulnerabilities/id/94736152-b365-4b3a-a786-ed49f7d0fc7a?source=cve\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://docs.stylemixthemes.com/masterstudy-lms/changelog-free-version#id-3.3.2\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://plugins.trac.wordpress.org/changeset/3059676/masterstudy-lms-learning-management-system\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-01T19:11:53.476Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-2409\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-08-08T18:33:47.419360Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:stylemixthemes:masterstudy_lms:*:*:*:*:*:*:*:*\"], \"vendor\": \"stylemixthemes\", \"product\": \"masterstudy_lms\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"3.3.2\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-08-08T18:34:42.080Z\"}}], \"cna\": {\"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Hiroho Shimada\"}], \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"}}], \"affected\": [{\"vendor\": \"stylemix\", \"product\": \"MasterStudy LMS WordPress Plugin \\u2013 for Online Courses and Education\", \"versions\": [{\"status\": \"affected\", \"version\": \"*\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"3.3.1\"}], \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2024-03-13T00:00:00.000Z\", \"value\": \"Vendor Notified\"}, {\"lang\": \"en\", \"time\": \"2024-03-28T00:00:00.000Z\", \"value\": \"Disclosed\"}], \"references\": [{\"url\": \"https://www.wordfence.com/threat-intel/vulnerabilities/id/94736152-b365-4b3a-a786-ed49f7d0fc7a?source=cve\"}, {\"url\": \"https://docs.stylemixthemes.com/masterstudy-lms/changelog-free-version#id-3.3.2\"}, {\"url\": \"https://plugins.trac.wordpress.org/changeset/3059676/masterstudy-lms-learning-management-system\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"The MasterStudy LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.1. This is due to insufficient validation checks within the _register_user() function called by the \u0027wp_ajax_nopriv_stm_lms_register\u0027 AJAX action. This makes it possible for unauthenticated attackers to register a user with administrator-level privileges when MasterStudy LMS Pro is installed and the LMS Forms Editor add-on is enabled.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"description\": \"CWE-266 Incorrect Privilege Assignment\"}]}], \"providerMetadata\": {\"orgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"shortName\": \"Wordfence\", \"dateUpdated\": \"2024-03-29T08:31:29.816Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-2409\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-08T18:34:51.364Z\", \"dateReserved\": \"2024-03-12T21:35:10.961Z\", \"assignerOrgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"datePublished\": \"2024-03-29T08:31:29.816Z\", \"assignerShortName\": \"Wordfence\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.