CVE-2024-37093: 
WordPress vulnerability analysis and mitigation

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in StylemixThemes MasterStudy LMS WordPress plugin, affecting versions through 3.2.1. The vulnerability was disclosed on January 2, 2025, and assigned identifier CVE-2024-37093 (NVD, Patchstack).

The vulnerability has been assigned a CVSS v3.1 base score of 8.8 HIGH by NIST NVD, with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. However, Patchstack assessed it with a lower CVSS score of 4.3 MEDIUM. The vulnerability requires no privileges (unauthenticated) but does require user interaction (NVD).

This CSRF vulnerability could allow malicious actors to force higher privileged users to execute unwanted actions under their current authentication. The potential impact includes unauthorized actions being performed on behalf of authenticated users (Patchstack).

The vulnerability is classified as having low severity impact and is considered unlikely to be exploited. It requires user interaction to be successful, making it somewhat more difficult to exploit in practice (Patchstack).

The vulnerability has been fixed in version 3.2.2 of the MasterStudy LMS plugin. Users are advised to update to version 3.2.2 or later to remove the vulnerability (Patchstack).