CVE-2024-1512 — AI Deep Analysis Summary

Q: Who is affected? (Versions/Components)

📦 **Affected Products:** * **Vendor:** Stylemix Themes * **Product:** MasterStudy LMS WordPress Plugin * **Version:** 3.2.5 and earlier versions are vulnerable. 📉

Q: Is exploitation threshold high? (Auth/Config)

🔓 **Exploitation Threshold: LOW** * **Authentication:** None required (Unauthenticated). 🚫 * **Access:** Network accessible via REST API. 🌐 * **Complexity:** Low. Simple parameter manipulation. 🎯

Q: Is there a public Exp? (PoC/Wild Exploitation)

💣 **Public Exploits Available:** Yes! PoCs are publicly available on GitHub (e.g., `rat-c/CVE-2024-1512`) and in Nuclei templates. Automated scanning tools can already detect and exploit this. ⚠️

Q: Is it fixed officially? (Patch/Mitigation)

🩹 **Official Fix:** Yes, the vendor has released a fix. Update to the latest version of the MasterStudy LMS plugin. The patch addresses the escaping issue in `StmStatistics.php`. ✅

Q: Is it urgent? (Priority Suggestion)

🚨 **Priority: CRITICAL** * **CVSS Score:** 9.8 (Critical). 📈 * **Urgency:** Immediate action required. Public exploits exist, and no auth is needed. Patch immediately to prevent data breaches. ⏳

Updated May 06, 2026 CVSS 9.8 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Critical SQL Injection in MasterStudy LMS!**

This vulnerability allows attackers to inject malicious SQL code via the `/lms/stm-lms/order/items` REST route. The plugin fails to escape the `user` parameter properly.…

Read full answer (login)

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause: CWE-89 (SQL Injection)**

The flaw is **insufficient escaping** of user-supplied input combined with **lack of prepared statements** in the SQL query.…

Read full answer (login)

Q3Who is affected? (Versions/Components)

📦 **Affected Products:**

*   **Vendor:** Stylemix Themes
*   **Product:** MasterStudy LMS WordPress Plugin
*   **Version:** 3.2.5 and earlier versions are vulnerable. 📉

Q4What can hackers do? (Privileges/Data)

🕵️ **Attacker Capabilities:**

Unauthenticated attackers can perform **Union-based SQL Injection**.…

Read full answer (login)

Q5Is exploitation threshold high? (Auth/Config)

🔓 **Exploitation Threshold: LOW**

*   **Authentication:** None required (Unauthenticated). 🚫
*   **Access:** Network accessible via REST API. 🌐
*   **Complexity:** Low. Simple parameter manipulation. 🎯

Q6Is there a public Exp? (PoC/Wild Exploitation)

💣 **Public Exploits Available:**

Yes! PoCs are publicly available on GitHub (e.g., `rat-c/CVE-2024-1512`) and in Nuclei templates. Automated scanning tools can already detect and exploit this. ⚠️

Q7How to self-check? (Features/Scanning)

🔍 **Self-Check Methods:**

 **Scan:** Use Nuclei with the CVE-2024-1512 template. 🧪
 **Verify:** Check if your site uses MasterStudy LMS version ≤ 3.2.5. 🕵️‍♂️
…

Read full answer (login)

Q8Is it fixed officially? (Patch/Mitigation)

🩹 **Official Fix:**

Yes, the vendor has released a fix. Update to the latest version of the MasterStudy LMS plugin. The patch addresses the escaping issue in `StmStatistics.php`. ✅

Q9What if no patch? (Workaround)

🛑 **No Patch? Mitigation:**

*   **Block Access:** Restrict access to `/lms/stm-lms/order/items` via WAF or firewall rules.…

Read full answer (login)

Q10Is it urgent? (Priority Suggestion)

🚨 **Priority: CRITICAL**

*   **CVSS Score:** 9.8 (Critical). 📈
*   **Urgency:** Immediate action required. Public exploits exist, and no auth is needed. Patch immediately to prevent data breaches. ⏳

Continue exploring

Vulnerability detail Full AI analysis (login) stylemix CWE-89