The vulnerability in the Stylemix MasterStudy LMS WordPress plugin allows an unauthorized party to retrieve embedded sensitive data from the system. This flaw is a classic case of Unauthorized Access to Sensitive Data, indicated by its CWE-497 classification. An attacker who can reach the vulnerable endpoint could expose configuration details, user credentials, or other confidential information that the plugin stores or processes.

The affected product is the MasterStudy LMS plugin for WordPress by Stylemix. All releases from the earliest version through 3.6.20 are vulnerable, with no specific patch version indicated in the data. Users running any of these versions should assume the plugin is susceptible to data exposure.

The CVSS score of 4.9 denotes moderate potential impact. The EPSS score of less than 1% indicates a relatively low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Likely, the attack vector is remote network access to a public WordPress endpoint, as the description does not mention authentication or other constraints. An attacker could trigger the data dump by sending a crafted request to the problematic plugin route.