High severity · published Jul 22, 2024
CVE-2024-5973
MasterStudy LMS < 3.3.24 - Privilege Escalation to Instructor
8.8
CVSS
0.5%
EPSS
No
On KEV
Description
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.3.24 does not prevent students from creating instructor accounts, which could be used to get access to functionalities they shouldn't have.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ML
MasterStudy LMS WordPress Plugin ·
before 3.3.24 · source: vendor, CISA
ML
Masterstudy Lms · Stylemixthemes
before 3.3.24 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-5973
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-5973
Exploit
https://wpscan.com/vulnerability/59abfb7c-d5ea-45f2-ab9a-4391978e3805/
More from MasterStudy LMS WordPress Plugin
7.2
CVE-2026-88843
MasterStudy LMS 3.5.29 - < 3.7.50 - Contributor+ LFI via Elementor Courses Categories Widget
5.3
CVE-2026-88846
MasterStudy LMS 2.3.0 - < 3.7.50 - Unauthenticated Account Creation with Registration Disabled
5.3
CVE-2026-81199
MasterStudy LMS < 3.7.46 - Unauthenticated Student Statistics Disclosure via student/stats REST Route
5.3
CVE-2026-81197
MasterStudy LMS < 3.7.46 - Unauthenticated Unpublished Course Title Disclosure via course-list REST Route
5.3
CVE-2026-81195
MasterStudy LMS < 3.7.46 - Unauthenticated Student Enrollment Disclosure via student-courses REST Route