CVE-2024-3136

Deeper analysis

The MasterStudy LMS plugin for WordPress is affected by a local file inclusion vulnerability in all versions through 3.3.3. The flaw resides in the handling of the "template" parameter within the plugin's helpers.php and templates.php components, enabling an attacker to supply an arbitrary file path that is subsequently included and executed by the PHP interpreter.

Unauthenticated remote attackers can exploit the issue over the network without any user interaction or credentials. Successful exploitation permits inclusion of attacker-controlled files, which can be leveraged to bypass access controls, read sensitive data, or obtain arbitrary code execution when combined with the ability to upload files such as images that contain embedded PHP.

Public references include Wordfence advisory data and WordPress plugin Trac changesets that document the corrective modifications applied to helpers.php and templates.php. Site administrators should apply the available plugin update that resolves the parameter handling weakness.

The associated EPSS score has remained stable at its peak value of 0.5421 with no indicated post-disclosure increase.