The MasterStudy LMS WordPress plugin before version 3.7.46 fails to perform an authorization check before returning a student’s learning statistics via the REST route /student/stats. As a result, any unauthenticated user can retrieve course counts, points, certificates, quiz totals, and assignment totals of any registered user. The exposed information is purely statistical; however, based on the description, it is inferred that access to such data could reveal student progress patterns and potentially aid targeted phishing or social engineering attempts, though it does not provide direct code execution or privilege escalation.

The vulnerable asset is the MasterStudy LMS plugin for WordPress. All installations using a version earlier than 3.7.46 are affected, regardless of other configurations or extensions.

The flaw can be triggered without authentication through a publicly accessible REST endpoint, meaning the attack surface is broad and no special privileges are required. The CVSS score of 5.3 indicates moderate severity. The EPSS score of 0.00095 indicates a very low but non‑zero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been observed. The likely attack vector is an unauthenticated HTTP request to the /student/stats endpoint. The impact is a privacy violation rather than a denial of service or remote execution.