CVE-2024-43239: Masteriyo LMS Auth Bypass Vulnerability

CVE-2024-43239 Overview

CVE-2024-43239 is an Insecure Direct Object Reference (IDOR) vulnerability in the Masteriyo LMS WordPress plugin (learning-management-system). The flaw affects all plugin versions up to and including 1.11.4. Attackers with low-privilege authenticated access can manipulate user-controlled key parameters to access or modify resources belonging to other users. The issue is tracked under [CWE-639: Authorization Bypass Through User-Controlled Key].

Critical Impact
Authenticated attackers can bypass authorization controls to read and modify data belonging to other users of the learning management system, compromising course content, student records, and account data.

Affected Products

Masteriyo LMS (learning-management-system) WordPress plugin versions up to and including 1.11.4
WordPress sites running Masteriyo LMS with authenticated user registration enabled
Learning platforms exposing student, instructor, or course objects via the plugin's endpoints

Discovery Timeline

2024-08-18 - CVE-2024-43239 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-43239

Vulnerability Analysis

The Masteriyo LMS plugin exposes application endpoints that reference internal objects, such as user profiles, orders, and course enrollments, using identifiers supplied directly by the client. The plugin fails to validate whether the authenticated caller owns or has permission to operate on the referenced object.

An attacker with a valid low-privilege account, such as a registered student, can substitute another user's identifier in a request. The server processes the request as though the caller were authorized. This yields both confidentiality and integrity impact, as reflected by the vector components C:H/I:H.

The vulnerability requires network access and low privileges but no user interaction, making it well-suited to automated enumeration across sequential identifiers.

Root Cause

The root cause is missing ownership and capability checks at the resource-access layer. The plugin trusts a user-controlled key, typically a numeric object ID passed in a REST request, as sufficient basis for authorization. Proper authorization requires a server-side check comparing the current session principal against the object owner or an equivalent capability grant.

Attack Vector

Exploitation follows a standard IDOR pattern. The attacker authenticates as any registered user, captures a legitimate request that references their own object ID, and replays the request while substituting other identifiers. Because the endpoint returns or mutates data based solely on the supplied key, the attacker retrieves or modifies records belonging to other accounts. Refer to the Patchstack advisory for endpoint-level detail.

// No verified proof-of-concept code is publicly available.
// Vulnerability mechanism is described in prose above.

Detection Methods for CVE-2024-43239

Indicators of Compromise

Web access logs showing a single authenticated session iterating sequential numeric IDs against Masteriyo REST routes under /wp-json/masteriyo/
Unexpected modification timestamps on user, order, or enrollment records tied to accounts the acting user does not own
Spikes in 200 OK responses to object-lookup endpoints from a single low-privilege session

Detection Strategies

Correlate the authenticated user_id in session cookies with the object owner field returned by Masteriyo endpoints; flag mismatches
Deploy WordPress audit logging to record REST API calls to plugin routes with the requesting user, target object ID, and HTTP status
Hunt for high-cardinality access patterns where one account touches many distinct object IDs in a short window

Monitoring Recommendations

Ingest WordPress and web-server logs into a centralized analytics pipeline for behavioral baselining of REST API usage
Alert on authenticated users accessing more than a threshold number of unique object identifiers per minute
Review database change logs for updates to user profile, billing, or enrollment tables initiated by non-administrative accounts

How to Mitigate CVE-2024-43239

Immediate Actions Required

Upgrade the Masteriyo LMS plugin to a version later than 1.11.4 that includes the vendor's authorization fix
Audit user accounts, course enrollments, and order records for unauthorized changes since the plugin was installed
Rotate credentials for any accounts that show anomalous access in web or REST API logs

Patch Information

The vendor released a fixed version following coordinated disclosure via Patchstack. Site operators should update to the latest Masteriyo LMS release available from the WordPress plugin repository. Refer to the Patchstack advisory for CVE-2024-43239 for the specific patched version.

Workarounds

Restrict registration on affected WordPress sites until the plugin is updated, reducing the pool of accounts that can exploit the flaw
Place the site behind a web application firewall (WAF) with rules that block requests to Masteriyo REST endpoints referencing object IDs outside the caller's session
Disable the Masteriyo LMS plugin if patching cannot be completed promptly

bash

# Update the plugin via WP-CLI on the WordPress host
wp plugin update learning-management-system
wp plugin get learning-management-system --field=version