Analysis Report · Folder Analysis cache/masterstudy-lms-learning-management-system_3.7.6 → cache/masterstudy-lms-learning-management-system_3.7.7 — CVE-2025-13766

I'll analyze this code diff for security vulnerabilities.

Vulnerability Existed: yes
TRUE POSITIVE
[CWE Name] CWE-284: Improper Access Control - [CWE ID] 284 - [File] includes/Http/Controllers/Course/CourseTemplate/CreateCourseTemplateController.php [Lines 14-22]

[Old Code]
```php
public function __invoke( WP_REST_Request $request ): \WP_REST_Response {
    $data = $request->get_json_params();

    if ( empty( $data['title'] ) ) {
        return WpResponseFactory::validation_failed( 'Missing title' );
    }
```

[Fixed Code]
```php
public function __invoke( WP_REST_Request $request ): \WP_REST_Response {
    $data = $request->get_json_params();

    if ( ! current_user_can( 'edit_posts' ) ) {
        return new \WP_REST_Response(
            array(
                'error_code' => 'create_template_access_error',
                'message'    => esc_html__( 'You do not have permission to create course templates.', 'masterstudy-lms-learning-management-system' ),
            ),
            403
        );
    }

    if ( empty( $data['title'] ) ) {
        return WpResponseFactory::validation_failed( 'Missing title' );
    }
```

Explanation:
The vulnerability was an **Improper Access Control** (CWE-284) issue. The original code was missing authorization checks before processing the REST API request to create course templates. Any authenticated user could create course templates without verifying they had the necessary permissions. The fix adds a capability check using `current_user_can( 'edit_posts' )` at the beginning of the function, returning a 403 Forbidden response if the user lacks the required capability. This prevents unauthorized users from accessing this sensitive endpoint.

Vulnerability Existed: yes
FALSE POSITIVE
Improper Access Control / Authorization - CWE-639 - DeleteCourseTemplateController.php lines 10-19 (added)

Old Code:
```php
public function __invoke( int $template_id ) {
    $result = ( new CourseTemplateRepository() )->delete( $template_id );
```

Fixed Code:
```php
public function __invoke( int $template_id ) {
    if ( ! current_user_can( 'delete_post', $template_id ) ) {
        return new \WP_REST_Response(
            array(
                'error_code' => 'delete_template_access_error',
                esc_html__( 'You do not have permission to delete course templates.', 'masterstudy-lms-learning-management-system' ),
            ),
            403
        );
    }

    $result = ( new CourseTemplateRepository() )->delete( $template_id );
```

Explanation:
The original code allowed any user to delete course templates without permission checks. The fix adds a proper authorization check using WordPress's `current_user_can()` function to verify the user has the 'delete_post' capability for the specific template before allowing deletion. This prevents unauthorized users from deleting course templates they shouldn't have access to, directly addressing an access control vulnerability. The fix also returns an appropriate 403 Forbidden HTTP status code with a user-friendly error message when access is denied.

```
Vulnerability Existed: yes
TRUE POSITIVE
Broken Access Control (Authorization) - CWE-639 - includes/Http/Controllers/Course/CourseTemplate/ModifyCourseTemplateController.php Lines 26-35

Old Code:
$data   = $request->get_json_params();
$result = ( new CourseTemplateRepository() )->modify_template( $data['title'], $data['post_id'] );

Fixed Code:
$data   = $request->get_json_params();

if ( ! current_user_can( 'edit_post', $data['post_id'] ) ) {
    return new \WP_REST_Response(
        array(
            'error_code' => 'modify_template_access_error',
            esc_html__( 'You do not have permission to update course templates.', 'masterstudy-lms-learning-management-system' ),
        ),
        403
    );
}

$result = ( new CourseTemplateRepository() )->modify_template( $data['title'], $data['post_id'] );

Explanation:
The original code was vulnerable to broken access control (authorization bypass). It accepted a `post_id` parameter from user input and directly passed it to `modify_template()` without verifying that the current user has permission to edit that specific post. This allowed an authenticated attacker to modify course templates they should not have access to by simply providing a `post_id` of another user's template.

The fix adds a proper authorization check using WordPress's `current_user_can( 'edit_post', $data['post_id'] )` function before processing the request. This ensures only users with the appropriate capabilities can modify the specified post, returning a 403 Forbidden response for unauthorized access attempts.
```

```
Vulnerability Existed: yes
TRUE POSITIVE
Improper Access Control - CWE-284 - includes/Http/Controllers/Course/CourseTemplate/UpdateCourseTemplateController.php - Lines 27-35

Old Code:
$data = $request->get_json_params();

$result = ( new CourseTemplateRepository() )->update( $data['course_style'] );

Fixed Code:
$data = $request->get_json_params();

if ( ! current_user_can( 'manage_options' ) ) {
	return new \WP_REST_Response(
		array(
			'error_code' => 'modify_template_access_error',
			esc_html__( 'You do not have permission to update course templates.', 'masterstudy-lms-learning-management-system' ),
		),
		403
	);
}

$result = ( new CourseTemplateRepository() )->update( $data['course_style'] );

Explanation:
The original code was missing authorization checks before allowing course template updates. Any authenticated user could potentially modify course templates by directly calling this endpoint, regardless of their role or permissions. The fix adds a capability check using `current_user_can( 'manage_options' )` to ensure only administrators can update course templates, returning a 403 Forbidden response for unauthorized users. This prevents privilege escalation and unauthorized modification of critical course configuration.
```

Vulnerability Existed: yes
TRUE POSITIVE
Broken Access Control - CWE-639 - includes/Http/Controllers/Media/UploadController.php - Lines 10-19

Old Code:
```php
public function __invoke( WP_REST_Request $request ) {
    $extensions = implode( ';', array_keys( apply_filters( 'upload_mimes', Media::MIMES ) ) );
```

Fixed Code:
```php
public function __invoke( WP_REST_Request $request ) {
    if ( ! current_user_can( 'upload_files' ) ) {
        return new \WP_REST_Response(
            array(
                'error_code' => 'media_upload_access_error',
                'message'    => esc_html__( 'You do not have permission to upload media files.', 'masterstudy-lms-learning-management-system' ),
            ),
            403
        );
    }

    $extensions = implode( ';', array_keys( apply_filters( 'upload_mimes', Media::MIMES ) ) );
```

Explanation:
The original code lacked authorization checks on the media upload endpoint. Any authenticated user could potentially upload files without proper permission validation. The fix adds a `current_user_can( 'upload_files' )` check that returns a 403 Forbidden response if the user lacks the required capability. This prevents unauthorized file uploads and properly enforces WordPress's role-based access control system. The fix also provides a clear error message using proper escaping (`esc_html__`), following WordPress security best practices.

```
Vulnerability Existed: yes
TRUE POSITIVE
Improper Access Control - CWE-284 - includes/Http/Controllers/Media/UploadFromUrlController.php - Lines 13-16

Old Code:
public function __invoke( WP_REST_Request $request ): WP_REST_Response {
    $validator = new Validator(
        $request->get_params(),

Fixed Code:
public function __invoke( WP_REST_Request $request ): WP_REST_Response {
    if ( ! current_user_can( 'upload_files' ) ) {
        return new \WP_REST_Response(
            array(
                'error_code' => 'delete_media_access_error',
                'message'    => esc_html__( 'You do not have permission to upload media files.', 'masterstudy-lms-learning-management-system' ),
            ),
            403
        );
    }

Explanation:
The original code was missing authorization checks before processing media file uploads via the REST API endpoint. An unauthenticated or unauthorized user could invoke the controller and attempt to upload files without the 'upload_files' capability. The fix adds a capability check using WordPress's `current_user_can()` function at the start of the request handler, returning a 403 Forbidden response if the user lacks the required permission. This prevents unauthorized file uploads and addresses the improper access control vulnerability (CWE-284).
```

Vulnerability Existed: yes
TRUE POSITIVE
Cross-Site Request Forgery (CSRF) / Unauthorized Access - CWE-352 / CWE-863 - includes/routes.php Lines 395-399

Old Code:
```php
array(
    'middleware' => array(
        \MasterStudy\Lms\Routing\Middleware\Authentication::class,
    ),
    'prefix'     => '/course-templates',
),
```

Fixed Code:
```php
array(
    'middleware' => array(
        \MasterStudy\Lms\Routing\Middleware\Authentication::class,
        \MasterStudy\Lms\Routing\Middleware\Instructor::class,
    ),
    'prefix'     => '/course-templates',
),
```

Explanation:
The `/course-templates` route previously only enforced authentication via the `Authentication` middleware. The addition of the `Instructor` middleware implements role-based access control (RBAC), restricting access to users with instructor privileges. Without this middleware, any authenticated user could access course template functionality regardless of their role, which is a privilege escalation vulnerability (CWE-863: Incorrect Authorization). The fix ensures that only instructors can access the `/course-templates` endpoint, preventing unauthorized users from modifying or viewing instructor-only resources.