CVE-2024-2106 is a medium severity flaw in the MasterStudy LMS plugin for WordPress, scored CVSS 5.3. Unauthenticated visitors can extract the usernames and email addresses of all registered users. It affects versions up to and including 3.2.10, so update and check the changelog.
What's affected
The record lists the MasterStudy LMS plugin for WordPress in all versions up to and including 3.2.10. The weakness is CWE-200, information exposure. NVD scores it 5.3 (Medium) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. It was published on 2024-03-13.
The record says unauthenticated attackers can extract sensitive data, including every registered user's username and email address, which can then help with later attacks such as phishing or password guessing. The CVSS vector lists no privileges and no user interaction.
On a learning platform, a list of student and instructor emails is more than trivia. It supports targeted phishing, and it reveals who is enrolled.
On the fix: The record's references include a WordPress.org changeset for tag 3.2.11 of the plugin, which suggests that 3.2.11 carries the change, but treat that as a lead and verify it in the changelog. The vendor advisory in the record is a Wordfence entry, which we could not retrieve, so we have not confirmed a fixed version beyond what the record's references show. The WordPress.org plugin or theme changelog is the authoritative source for the first patched release.
How to check if you're exposed
If you manage WordPress sites, the quickest check is the version list. With WP-CLI, run it from the site root:
wp plugin list --fields=name,version,update
wp plugin get masterstudy-lms-learning-management-system --field=version
Without shell access, open the Plugins or Themes screen in the dashboard and read the version under the MasterStudy LMS entry. Anything at 3.2.10 or below is in the affected range.
For a fleet of sites, ask your hosting panel or management tool for an inventory by plugin slug. The slug used by WordPress.org for this item is masterstudy-lms-learning-management-system. Do not forget staging copies, old multisite networks and sites that nobody logs into, because those are the ones that stay out of date.
You can also run the free in-browser dependency scan against a project that vendors this code, and use the Gold page for CVE-2024-2106 to follow the record as new information is added.
What to do now
- List every site that has MasterStudy LMS installed, and note the version on each.
- Update MasterStudy LMS to the latest release from WordPress.org. The record names 3.2.10 as the last affected version, so anything newer is the target.
- If you cannot update right now, deactivate and remove it if it is not essential, or restrict access to the affected feature at the web server level.
- Review user accounts. Remove stale users, and check that roles match what each person actually needs.
- Turn on automatic updates for plugins and themes that you trust, so the next fix lands without a ticket.
- Re-check the version after updating and confirm that no cached copy of an old release remains.
Why it matters
Information exposure flaws like this one tend to appear when a feature is written for a trusted audience and then served to a wider one. Here the route handling in the plugin exposed account details to anyone who asked. The class of problem is exposing data through an endpoint without checking who is requesting it.
The practical risk depends on the site. Information exposure on a brochure site is a smaller problem than on a site that holds user data. Use the CVSS score as a starting point, then ask what your site stores. CVE-2024-2106 is not on the CISA Known Exploited Vulnerabilities list, and none of the sources we read report exploitation in the wild.
Quick check
Is CVE-2024-2106 fixed?
The record names 3.2.10 as the last affected version. Update to the newest release and confirm the changelog mentions the fix.
Is CVE-2024-2106 exploited in the wild?
It is not on the CISA Known Exploited Vulnerabilities list, and the sources we read do not report exploitation.
Sources
- Gold entry for CVE-2024-2106
- NVD record for CVE-2024-2106 as held in the Safeguard record set. The Wordfence entry and the WordPress.org changeset referenced by the record could not be retrieved.
Last reviewed: 19 October 2026.
