CVE-2024-1904: 
WordPress vulnerability analysis and mitigation

The MasterStudy LMS plugin for WordPress contains a vulnerability (CVE-2024-1904) related to unauthorized access of data due to a missing capability check on the search_posts function. This vulnerability affects all versions up to and including 3.2.13. The issue was discovered and disclosed in April 2024, with a fix released in version 3.3.0 (NVD, WordPress Plugin).

The vulnerability stems from a missing capability check in the search_posts function within the MasterStudy LMS WordPress plugin. This security flaw has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The vulnerability is classified under CWE-862 (Missing Authorization) (NVD).

The vulnerability allows authenticated attackers with subscriber-level access or higher to expose draft post titles and excerpts, potentially leading to unauthorized access to sensitive content that was not intended to be publicly visible (NVD).

The vulnerability has been patched in version 3.3.0 of the MasterStudy LMS plugin. Users are advised to update to this version or later to mitigate the security risk (WordPress Plugin).