CVE-2024-37093: MasterStudy LMS CSRF Vulnerability

CVE-2024-37093 Overview

CVE-2024-37093 is a Cross-Site Request Forgery (CSRF) vulnerability in the Stylemix MasterStudy LMS WordPress plugin. The flaw affects all versions of masterstudy-lms-learning-management-system up through 3.2.1. An attacker can craft a malicious web page that, when visited by an authenticated user, causes the victim's browser to issue forged state-changing requests to the LMS application. Because the affected endpoints lack anti-CSRF token validation [CWE-352], the application processes those requests using the victim's session privileges. Successful exploitation can compromise confidentiality, integrity, and availability of the LMS instance.

Critical Impact

A network-based attacker who tricks an authenticated MasterStudy LMS user into visiting a crafted page can perform privileged actions on the WordPress site, potentially leading to full compromise of LMS data and configuration.

Affected Products

• Stylemix MasterStudy LMS WordPress plugin (masterstudy-lms-learning-management-system)
• All versions from n/a through <= 3.2.1
• WordPress sites running the vulnerable plugin with authenticated administrators or instructors

Discovery Timeline

• 2025-01-02 - CVE-2024-37093 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2024-37093

Vulnerability Analysis

The vulnerability is a server-side failure to verify the origin and intent of state-changing HTTP requests. MasterStudy LMS exposes administrative and configuration endpoints that do not require a valid WordPress nonce or equivalent anti-CSRF token. An attacker hosts a malicious page containing an auto-submitting form or image tag targeting these endpoints. When an authenticated administrator or privileged user visits the page, the browser automatically attaches the WordPress session cookie. The LMS endpoint executes the request as the victim, performing actions the attacker chose. User interaction is required, which is consistent with classic CSRF exploitation flows.

Root Cause

The root cause is missing CSRF protection on sensitive plugin endpoints in MasterStudy LMS versions through 3.2.1 [CWE-352]. WordPress provides the wp_create_nonce() and check_admin_referer() primitives for this purpose, but the affected handlers either omit the nonce check or fail to validate it correctly. Without this control, the application cannot distinguish legitimate, user-initiated requests from forged cross-origin requests.

Attack Vector

Exploitation occurs over the network and requires user interaction. An attacker delivers a link or embeds malicious markup on a site the victim visits while authenticated to the WordPress admin panel. The forged request inherits the victim's privileges, allowing the attacker to modify LMS settings, manipulate course data, or perform other privileged actions depending on the endpoint targeted. No authentication credentials are required from the attacker. Refer to the Patchstack WordPress Plugin Advisory for additional technical context.

Detection Methods for CVE-2024-37093

Indicators of Compromise

• Unexpected state changes in MasterStudy LMS configuration, courses, or user accounts that do not correlate with legitimate admin activity.
• WordPress access logs showing POST requests to MasterStudy LMS endpoints with Referer headers pointing to external, untrusted domains.
• Authenticated admin sessions issuing requests immediately after the user clicked a suspicious external link or email.

Detection Strategies

• Inspect web server logs for requests to wp-admin/admin-ajax.php or MasterStudy LMS handlers where the Referer or Origin header is missing or external.
• Correlate WordPress audit logs with browser history or email gateway logs to identify cross-origin request patterns preceding privileged actions.
• Deploy a Web Application Firewall (WAF) rule that flags state-changing requests to the plugin lacking a valid nonce parameter.

Monitoring Recommendations

• Enable a WordPress activity logging plugin to record administrative actions with timestamps, IP addresses, and originating user agents.
• Forward WordPress and reverse-proxy logs to a centralized SIEM and alert on anomalous admin actions originating from unusual referrers.
• Monitor for newly created administrator accounts or privilege changes within MasterStudy LMS roles.

How to Mitigate CVE-2024-37093

Immediate Actions Required

• Update the MasterStudy LMS plugin to a version later than 3.2.1 that includes the CSRF fix.
• Audit MasterStudy LMS configuration, user roles, and course content for unauthorized changes since the plugin was installed.
• Force a password reset and session invalidation for all administrator and instructor accounts.
• Review WordPress activity logs for suspicious admin actions originating from external referrers.

Patch Information

Stylemix has addressed the issue in a release subsequent to 3.2.1. Site operators should upgrade masterstudy-lms-learning-management-system to the latest version available in the WordPress plugin repository. Confirm patch details and fixed version numbers through the Patchstack WordPress Plugin Advisory before deploying.

Workarounds

• Restrict access to wp-admin by IP allowlist at the web server or WAF layer until the plugin can be updated.
• Require administrators to use a separate browser profile for WordPress administration to limit exposure to cross-origin attacks.
• Deploy a WAF rule that blocks requests to MasterStudy LMS endpoints lacking a valid _wpnonce parameter or with off-site Referer headers.
• Enforce the SameSite=Strict or SameSite=Lax cookie attribute on the WordPress authentication cookie where compatible.

# Example WAF rule (ModSecurity) to block state-changing requests
# to MasterStudy LMS endpoints without a nonce parameter
SecRule REQUEST_METHOD "@streq POST" \
  "chain,id:1004373,phase:2,deny,status:403,log,msg:'CVE-2024-37093 CSRF guard'"
  SecRule REQUEST_URI "@contains masterstudy" \
    "chain"
    SecRule &ARGS:_wpnonce "@eq 0"