GCVE - cpe:2.3:a:stylemixthemes:masterstudy_lms:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:stylemixthemes:masterstudy_lms:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Stylemixthemes (`a955917c-2229-564b-bd01-1fb4beeda74f`)
Product	Masterstudy Lms (`4c3fdb65-dc60-5838-94f4-bf7903ddc125`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-3136`	vulnerable	2026-06-03 14:56:23.562189	MasterStudy LMS <= 3.3.3 - Unauthenticated Local File Inclusion via template CRITICAL (9.8) The MasterStudy LMS plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.3 via the 'template' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Published: 2024-04-09T18:59:08.441Z Updated: 2026-04-08T17:11:02.846Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/9a573740-cdfe-4b58-b33b-5e50bcbc4779?source=cve https://plugins.trac.wordpress.org/changeset/3064337/masterstudy-lms-learning-management-system/trunk/_core/lms/classes/templates.php https://plugins.trac.wordpress.org/changeset/3064337/masterstudy-lms-learning-management-system/trunk/_core/lms/classes/helpers.php	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-37094`	vulnerable	2026-06-03 14:56:05.756160	WordPress MasterStudy LMS plugin <= 3.2.12 - Broken Access Control vulnerability HIGH (8.2) Missing Authorization vulnerability in StylemixThemes MasterStudy LMS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MasterStudy LMS: from n/a through 3.2.12. Published: 2024-11-01T13:52:58.720Z Updated: 2026-04-28T16:09:55.793Z Open on db.gcve.eu Reference links https://patchstack.com/database/vulnerability/masterstudy-lms-learning-management-system/wordpress-masterstudy-lms-plugin-3-2-12-broken-access-control-vulnerability?_s_id=cve	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-2409`	vulnerable	2026-06-03 14:55:29.174506	MasterStudy LMS <= 3.3.1 - Unauthenticated Privilege Escalation via stm_lms_register AJAX Action CRITICAL (9.8) The MasterStudy LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.1. This is due to insufficient validation checks within the _register_user() function called by the 'wp_ajax_nopriv_stm_lms_register' AJAX action. This makes it possible for unauthenticated attackers to register a user with administrator-level privileges when MasterStudy LMS Pro is installed and the LMS Forms Editor add-on is enabled. Published: 2024-03-29T08:31:29.816Z Updated: 2026-04-08T17:09:52.197Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/94736152-b365-4b3a-a786-ed49f7d0fc7a?source=cve https://docs.stylemixthemes.com/masterstudy-lms/changelog-free-version#id-3.3.2 https://plugins.trac.wordpress.org/changeset/3059676/masterstudy-lms-learning-management-system	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.