The Masteriyo LMS – eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to unauthorized user profile modification due to missing authorization checks on the /wp-json/masteriyo/v1/users/$id REST API endpoint in all versions up to, and including, 1.13.3. This makes it possible for authenticated attackers, with student-level access and above, to modify the roles of arbitrary users. As a result, attackers can escalate their privileges to the Administrator and demote existing administrators to students.
Metrics
Affected Vendors & Products
References
History
Tue, 29 Oct 2024 19:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Masteriyo
Masteriyo masteriyo |
|
CPEs | cpe:2.3:a:masteriyo:masteriyo:*:*:*:*:*:wordpress:*:* | |
Vendors & Products |
Masteriyo
Masteriyo masteriyo |
|
Metrics |
ssvc
|
Tue, 29 Oct 2024 05:45:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | The Masteriyo LMS – eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to unauthorized user profile modification due to missing authorization checks on the /wp-json/masteriyo/v1/users/$id REST API endpoint in all versions up to, and including, 1.13.3. This makes it possible for authenticated attackers, with student-level access and above, to modify the roles of arbitrary users. As a result, attackers can escalate their privileges to the Administrator and demote existing administrators to students. | |
Title | Masteriyo LMS – eLearning and Online Course Builder for WordPress <= 1.13.3 - Authenticated (Student+) Missing Authorization to Privilege Escalation | |
Weaknesses | CWE-862 | |
References |
| |
Metrics |
cvssV3_1
|

Status: PUBLISHED
Assigner: Wordfence
Published: 2024-10-29T05:32:38.183Z
Updated: 2024-10-29T18:33:36.616Z
Reserved: 2024-10-15T19:13:37.095Z
Link: CVE-2024-10008

Updated: 2024-10-29T18:33:28.867Z

Status : Awaiting Analysis
Published: 2024-10-29T06:15:13.743
Modified: 2024-10-29T14:34:04.427
Link: CVE-2024-10008

No data.