The vulnerability in WisdomGarden's Tronclass is an Insecure Direct Object Reference (CWE‑639) that allows an authenticated remote attacker to modify a specific request parameter and retrieve peer review scores for any student. This flaw enables the attacker to read confidential assessment data that should be restricted to authorized personnel, thereby compromising the confidentiality of student performance information.

WisdomGarden’s Tronclass application is affected. No specific sub‑versions are listed, so any deployed instance of Tronclass is potentially vulnerable until patched with the vendor’s hotfixes.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of less than 1% suggests a low likelihood of exploitation at present, and the vulnerability is not listed in CISA’s KEV catalog. Attackers need valid credentials to authenticate to the system and then alter a request parameter, indicating the attack vector is authenticated remote. Given these conditions, the overall risk is moderate, with mitigation prioritized through vendor patches and access‑control hardening.