CVE-2025-64213CWE-201

CVE-2025-64213

High · published December 18, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
28.5
In the wild
Unconfirmed
What it is

⚡ A vulnerable version of StylemixThemes MasterStudy LMS Pro can expose sensitive information embedded in sent data—ouch! 🔥 This is like a waiter accidentally spilling a customer's personal order details to everyone at the table—yikes! It's a classic case of a data leak where the information was never meant to be shared publicly. An attacker could potentially retrieve sensitive data, like email addresses or user details, leading to privacy breaches or targeted phishing attacks. With a CVSS score of 7.5, this is a high-risk situation that can seriously compromise user trust and security.

Put simply

This is like a waiter accidentally spilling a customer's personal order details to everyone at the table—yikes! It's a classic case of a data leak where the information was never meant to be shared publicly. This vulnerability allows the insertion of sensitive information into sent data, affecting MasterStudy LMS Pro versions prior to 4.7.16. This means that any data embedded in the system can be retrieved by unauthorized parties, which is a significant risk.

What to do

An attacker could potentially retrieve sensitive data, like email addresses or user details, leading to privacy breaches or targeted phishing attacks. With a CVSS score of 7.5, this is a high-risk situation that can seriously compromise user trust and security. Update your MasterStudy LMS Pro to version 4.7.16 or later immediately to patch this vulnerability. Be sure to audit any sensitive information being sent to ensure it is adequately protected. Additionally, review your data handling practices to prevent future leaks. You’ve got this! By taking these steps, you'll shield your users from potential data exposure and enhance your security stance! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00359 · 28.5th percentile
Weakness
CWE-201 · Insertion of Sensitive Information Into Sent Data
Published
2025-12-18T13:16Z
References (1)
EPSS history
Timeline
  • 18 DEC 07:22Z
    WordPress MasterStudy LMS Pro plugin < 4.7.16 - Sensitive Data Exposure vulnerability
    cvelistv5