CVE-2024-1512 in MasterStudy LMS WordPress Plugin
Summary
by MITRE • 02/17/2024
The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to union based SQL Injection via the 'user' parameter of the /lms/stm-lms/order/items REST route in all versions up to, and including, 3.2.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 04/12/2026
The vulnerability identified as CVE-2024-1512 affects the MasterStudy LMS WordPress plugin, a widely used educational platform for online course delivery. This particular flaw exists within the REST API endpoint at /lms/stm-lms/order/items where the plugin fails to properly sanitize user input. The issue manifests through the 'user' parameter which is directly incorporated into SQL queries without adequate escaping mechanisms. This represents a classic union-based SQL injection vulnerability that has been classified under CWE-89, which specifically addresses improper neutralization of special elements used in SQL commands. The vulnerability impacts all versions of the plugin up to and including version 3.2.5, making it a significant concern for organizations relying on this educational platform for their learning management needs.
The technical exploitation of this vulnerability occurs through the REST API interface where unauthenticated attackers can craft malicious requests containing specially formatted input in the 'user' parameter. When the plugin processes this parameter, it concatenates the user-supplied data directly into the SQL query structure without proper parameterization or escaping. This allows attackers to inject additional SQL commands that can be executed within the context of the database connection. The union-based nature of the injection means that attackers can leverage UNION operators to combine their malicious queries with legitimate database queries, enabling them to extract sensitive information such as user credentials, personal data, course materials, and administrative details from the underlying database system.
From an operational impact perspective, this vulnerability creates a severe risk for educational institutions and organizations using the MasterStudy LMS plugin. The lack of authentication requirements for exploiting this vulnerability means that any individual with access to the web application can potentially compromise the entire database. Attackers could extract user account information including usernames and password hashes, access confidential course content, manipulate enrollment data, and potentially escalate privileges within the system. The vulnerability also presents a significant risk for data integrity and privacy compliance, particularly in environments subject to regulations such as gdpr,FERPA, or other data protection frameworks. The potential for data exfiltration and system compromise makes this vulnerability particularly dangerous for organizations handling sensitive educational data and personal information of students and staff members.
Mitigation strategies for CVE-2024-1512 should prioritize immediate patching of the affected plugin to version 3.2.6 or later, which contains the necessary security fixes. Organizations should implement network-level protections such as web application firewalls to monitor and block suspicious API requests targeting the vulnerable endpoint. Input validation and parameterized queries should be enforced at the application level to prevent similar issues in the future. Regular security audits and vulnerability assessments of WordPress plugins should be conducted to identify and remediate similar vulnerabilities. Additionally, organizations should implement proper access controls and monitoring for REST API endpoints to detect unauthorized access attempts. The ATT&CK framework categorizes this type of vulnerability under T1071.004 for Application Layer Protocol and T1566 for Phishing, highlighting the need for both defensive measures and threat intelligence to protect against exploitation attempts. System administrators should also consider implementing database activity monitoring to detect unauthorized data access patterns that may indicate successful exploitation of this vulnerability.