Masteriyo LMS – Online Course Builder for eLearning, LMS & Education Security & Risk Analysis

The 'learning-management-system' plugin v2.1.6 presents a mixed security posture. While it demonstrates good practices in areas like SQL query preparation (91%) and output escaping (95%), significant concerns arise from its attack surface and vulnerability history. The plugin exposes 11 entry points, with an alarming 10 of them lacking authentication checks. This wide, unprotected attack surface is a major risk, as it allows unauthenticated access to potentially sensitive functionalities. Furthermore, the presence of dangerous functions like `unserialize` and a critical taint flow with unsanitized paths indicate potential vulnerabilities that could be exploited for code execution or data manipulation. The plugin's history is deeply concerning, with a total of 10 known CVEs, including one critical and one high severity vulnerability. The types of past vulnerabilities (Exposure of Sensitive Information, XSS, Missing Authorization, Authorization Bypass) align with the risks identified in the static analysis, suggesting a pattern of recurring security weaknesses. The fact that all past vulnerabilities are reported as unpatched in the provided history is a severe indicator of ongoing risk, despite the 'currently unpatched: 0' field. The last vulnerability being dated 2025-11-30 implies this data might be from the future or represent an unpatched state. Given these factors, the plugin is considered high risk, with immediate attention required to address the unprotected entry points and historical vulnerabilities.