CVE-2024-3942 is a missing authorization vulnerability in the stylemix MasterStudy LMS WordPress Plugin, affecting versions up to 3.3.8. The plugin fails to enforce capability checks on several functions, enabling authenticated users with low-level permissions (subscriber and above) to read and modify sensitive content including course questions, post titles, and taxonomies. This can lead to unauthorized data access and modification. The CVSS 3.1 base score is 6.3 (medium), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and impacts on confidentiality, integrity, and availability.

Authenticated users with subscriber-level permissions or higher can exploit this vulnerability to read and modify course-related content and taxonomy data within the affected plugin. This unauthorized access and modification could compromise the integrity and confidentiality of educational content and potentially disrupt course delivery or data accuracy.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles and permissions to trusted users only and monitor for unusual activity related to course content modifications. Avoid granting subscriber or higher permissions to untrusted users. Follow the vendor's updates closely for an official patch or mitigation instructions.