Security readout for executives and security teams
Plain-English summary
A flaw in the MasterStudy LMS WordPress plugin (versions through 3.6.20) lets a logged-in user retrieve sensitive system information they should not see. The data exposure could help an attacker plan further attacks against the learning site, but it does not directly damage data or take the site offline on its own.
Executive priority
Treat as moderate priority. The flaw needs an authenticated user and only leaks information, but LMS platforms typically allow self-registration, which widens exposure. Schedule patching in the next standard maintenance window and verify whether sensitive system data was exposed.
Technical view
Patchstack reports a CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere) issue in Stylemix MasterStudy LMS through 3.6.20. CVSS 3.1 base 5.0 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) indicates a network-reachable, low-complexity flaw requiring low privileges with a scope change and limited confidentiality impact. No integrity or availability impact is recorded.
Likely exposure
Any WordPress site running MasterStudy LMS at or below version 3.6.20 where authenticated accounts (including low-privilege roles such as students or subscribers) can reach the vulnerable functionality over the network.
Exploitation context
Not listed in CISA KEV. No public exploitation, weaponized exploit, or in-the-wild activity is cited in the provided sources. The advisory comes from Patchstack's vulnerability database and describes the issue as sensitive data exposure rather than active compromise.
Researcher notes
CVSS scope change (S:C) with confidentiality-only impact aligns with information disclosure crossing a trust boundary. CWE-497 suggests embedded system data is returned to a caller that should not receive it. The advisory marks affected versions through 3.6.20 with default status "unaffected"; treat the fixed version as whatever Stylemix/Patchstack designates above 3.6.20. No PoC, KEV listing, or EPSS data is included in the bundle.
Mitigation direction
- Inventory WordPress sites for the MasterStudy LMS plugin and record installed versions.
- Check Stylemix and Patchstack advisories for a fixed release above 3.6.20 and update promptly.
- If no patch is available, restrict or audit low-privilege LMS accounts and consider disabling the plugin.
- Apply WAF or virtual patching rules from your security vendor where supported.
- Rotate any secrets or system details that may have been exposed through the affected functionality.
Validation and detection
- Confirm plugin version via WordPress admin or wp-cli for every site hosting MasterStudy LMS.
- Review web and plugin logs for unusual authenticated requests targeting LMS endpoints.
- After updating, verify the installed version exceeds 3.6.20 per vendor guidance.
- Monitor Patchstack and the CVE record for changes in status, fix availability, or exploitation reports.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-497: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-59575 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N3.11.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Exposure of Sensitive System Information to an Unauthorized Control Sphere
Exposure of Sensitive System Information to an Unauthorized Control Sphere represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.