CVE-2023-35093 - CVE House

Back to Database

Status published Medium CVE-2023-35093

WordPress MasterStudy LMS Plugin <= 3.0.8 is vulnerable to Broken Access Control

6.5 CVSS

Vulnerability Description

Broken Access Control vulnerability in StylemixThemes MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin <= 3.0.8 versions allows any logged-in users, such as subscribers to view the "Orders" of the plugin and get the data related to the order like email, username, and more.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-35093

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Rafshanzani Suhada (Patchstack Alliance)

References

https://patchstack.com/database/vulnerability/masterstudy-lms-learning-management-system/wordpress-masterstudy-lms-plugin-3-0-7-broken-access-control-vulnerability?_s_id=cve

More from StylemixThemes

View All →

MasterStudy LMS – Online Courses, eLearning PRO Plus <= 4.7.9 - Authenticated (Subscriber+) Arbitrary File Upload

WordPress Splash - Sport Club WordPress theme for Basketball, Football, Hockey theme <= 4.4.3 - Local File Inclusion vulnerability

WordPress Motors theme <= 5.6.81 - Arbitrary File Upload vulnerability

WordPress Masterstudy theme < 4.8.126 - Local File Inclusion vulnerability

WordPress Consulting Elementor Widgets plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerability

Affected Vendor

StylemixThemes

View all reports →

Affected Software

MasterStudy LMS WordPress Plugin – for Online Courses and Education

Vulnerable Versions:

Unknown

Timeline

Official Publish: June 22nd, 2023

Last Modified: April 28th, 2026

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1078 Valid Accounts

T1531 Account Access Removal