Masteriyo LMS CVE-2024-24882

Exploitation requires that the target WordPress site has the Masteriyo - LMS plugin installed and activated at version 1.7.2 or earlier, and that the vulnerable plugin endpoints are reachable over the network (the default for any publicly accessible WordPress site running the plugin). Per the CVSS vector AV:N/AC:L/PR:N/UI:N, no authentication, no user interaction, and no special configuration beyond the plugin being active is needed. The principal limiting factor is plugin presence and version: sites that do not run Masteriyo, or that run a version above 1.7.2, are not affected; sites that have firewalled the WordPress REST API or plugin endpoints from the public internet also limit exposure.

The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N indicates network-reachable, low-complexity exploitation with no authentication and no user interaction, and C:H/I:H/A:H reflects full impact across confidentiality, integrity, and availability - consistent with a critical 9.8 rating. EPSS at 31.54% (97th percentile) is unusually high and signals elevated likelihood of exploitation attempts relative to the broader CVE population, even though the issue is not currently in CISA KEV and no public exploit code is identified at time of analysis. The Patchstack tag of 'Information Disclosure' is narrower than the CVSS impact, which is a mild conflict - CVSS suggests full compromise via privilege escalation while the tag emphasizes data exposure; defenders should treat the CVSS picture as the worst-case envelope. Overall this is a real priority for any WordPress site running Masteriyo <= 1.7.2, particularly because plugin-targeting bots routinely sweep the public internet for known LMS flaws.

An unauthenticated attacker scans the public web for WordPress sites running Masteriyo LMS <= 1.7.2, then sends a crafted HTTP request to a vulnerable plugin endpoint that mis-assigns privileges, granting the attacker an elevated role on the site. With elevated privileges the attacker can read or modify course content, exfiltrate enrolled-student PII, plant malicious JavaScript in lessons, or pivot to broader administrative control of the WordPress instance. No public exploit is identified at time of analysis, but the high EPSS percentile suggests automated scanning and exploitation attempts are plausible.