CyberRota Analysis
AI-GeneratedThe MasterStudy LMS WordPress Plugin prior to version 3.7.42 has a vulnerability that allows users with the instructor role to access sensitive billing information of other users, including names, email addresses, phone numbers, and postal addresses, by enumerating order IDs. This exposure of personal data poses a significant privacy risk. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate potential data breaches.
Original NVD Description
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.42 does not correctly restrict access to order information, allowing any user with the instructor role to read other users' order billing details, including name, email address, phone number and postal address, by enumerating order IDs.