CVE-2024-37093

CVE-2024-37093 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the Stylemix MasterStudy LMS WordPress plugin (masterstudy-lms-learning-management-system). This issue affects versions from n/a through 3.2.1, allowing CSRF attacks that enable unauthorized actions.

The vulnerability carries a CVSS v3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N). Attackers with network access can exploit it with low complexity and no required privileges, but it necessitates user interaction, such as visiting a malicious site or clicking a crafted link. Exploitation results in low integrity impact, permitting attackers to perform state-changing operations on behalf of authenticated users without their knowledge or consent.

Advisories, including the Patchstack database entry at https://patchstack.com/database/Wordpress/Plugin/masterstudy-lms-learning-management-system/vulnerability/wordpress-masterstudy-lms-wordpress-plugin-plugin-3-2-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve, provide details on the vulnerability specific to MasterStudy LMS WordPress plugin version 3.2.1. Security practitioners should consult these resources for recommended mitigations, such as applying available patches or implementing CSRF protections.