Threats tagged 'ghsa-hp8j-2mhm-c28w'

The MasterStudy LMS plugin for WordPress versions before 3.7.50 has a missing authorization vulnerability. This flaw allows any authenticated user, including those with minimal privileges such as Subscribers, to trigger the stm_lms_send_test_email_ajax AJAX action without proper capability or nonce validation. Exploitation can lead to an uncaught PHP fatal error that may disclose the absolute filesystem path of the plugin if PHP error display is enabled.