Vulnerability · Published Jul 31, 2023 · Assigned by WPScan

CVE-2023-3345LMS by Masteriyo < 1.6.8 - Information Exposure

Medium 6.5

In plain English

A medium-severity security flaw in LMS by Masteriyo from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 80% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS NVD)6.5Medium

Exploit odds (30 days)2.0%top 19.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Nuclei

Official description

The LMS by Masteriyo WordPress plugin before 1.6.8 does not have proper authorization in one some of its REST API endpoints, making it possible for any students to retrieve email addresses of other students

Affected products (as reported)

Vendor	Product	Versions
Unknown	LMS by Masteriyo	0 – before 1.6.8

References

https://wpscan.com/vulnerability/0d07423e-98d2-43a3-824d-562747a3d65a exploit, vdb-entry, technical-description