The MasterStudy LMS WordPress Plugin before version 3.7.46 fails to verify that a quiz question identifier belongs to the instructor who is making the request, allowing an instructor to read other instructors’ quiz questions, including the correct answers and explanations. This flaw enables the disclosure of protected academic content and can undermine the integrity of examinations and assessments.

The vulnerability affects installations of the MasterStudy LMS WordPress Plugin with versions earlier than 3.7.46. Anyone with instructor privileges on a WordPress site that hosts this plugin can exploit the flaw.

The flaw is exploitable only by users who already hold instructor access, so it represents a moderate internal threat. No public exploitation data or KEV listing exists, and an EPSS score is not available, indicating a lower likelihood of widespread attack. However, once an instructor exploits the flaw, they can view and potentially share other instructors’ quiz answers, compromising course confidentiality. The CVSS score is 2.7, indicating a low severity but still noteworthy for organizations relying on the integrity of quiz content.