EUVD-2026-39186
GHSA-xp2v-x6vp-vp42
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Permanent deletion of course records warrants A:L; the provided NVD vector omits this impact despite the description explicitly confirming destructive capability.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Masteriyo LMS WordPress plugin before 2.2.1 does not perform authorization checks in a course-progress REST API controller, allowing unauthenticated users to read and permanently delete any user's course-progress records.
AnalysisAI
Unauthenticated access to Masteriyo LMS WordPress plugin's course-progress REST API controller exposes all users' learning records to read and permanent deletion. All plugin versions before 2.2.1 are affected due to a missing authorization check on the REST endpoint, meaning any unauthenticated HTTP client can target arbitrary user IDs. A publicly available proof-of-concept exists per WPScan; however, EPSS sits at just 0.14% (3rd percentile), suggesting opportunistic exploitation has not yet materialized at scale despite the low barrier to entry.
Technical ContextAI
Masteriyo LMS is a WordPress plugin that exposes learning-management functionality, including course progress tracking, via the WordPress REST API. The vulnerability resides in the course-progress REST API controller, which registers one or more REST routes without enforcing WordPress capability or nonce checks - a classic missing authorization pattern (analogous to CWE-862, though NVD has not formally assigned a CWE). Because WordPress REST API endpoints are publicly reachable by default at /wp-json/, the absence of a permission_callback or equivalent guard means any HTTP client, authenticated or not, can invoke read and delete operations. The CPE string cpe:2.3:a:unknown:masteriyo_lms:*:*:*:*:*:*:*:* covers all versions up to but not including 2.2.1, with the vendor field listed as 'unknown' in the NVD CPE dictionary at time of analysis.
RemediationAI
Update the Masteriyo LMS WordPress plugin to version 2.2.1 or later, which is the vendor-released patch confirmed by WPScan (https://wpscan.com/vulnerability/61d2f6ad-8450-40ae-862d-cafff38c27a0/). If immediate upgrade is not possible, a compensating control is to block external access to the affected REST API route at the web server or WAF layer - for example, adding a deny rule for requests matching /wp-json/ paths associated with the course-progress controller. This workaround carries the trade-off of breaking legitimate LMS functionality for enrolled users. Alternatively, restricting REST API access to authenticated sessions via a WordPress security plugin (e.g., using the 'Disable REST API' plugin with authenticated-only exemptions) reduces exposure while preserving functionality for logged-in learners. Neither workaround substitutes for the patch.
More in Masteriyo Lms
View allUnauthenticated arbitrary user session termination (force-logout) in the Masteriyo LMS WordPress plugin before version 2
Stored Cross-Site Scripting in the Masteriyo LMS WordPress plugin before version 3.4.0 allows any user holding the cours
Stored Cross-Site Scripting in the Masteriyo LMS WordPress plugin (all versions before 2.3.3) allows instructor-role use
Unauthenticated arbitrary file upload in the Masteriyo LMS WordPress plugin (versions <= 2.3.2) lets remote attackers up
Enrollment record exposure in the Masteriyo LMS WordPress plugin (versions 1.3.1 through below 3.4.0) lets unauthenticat
PHP Object Injection in the Masteriyo LMS WordPress plugin (versions <= 3.4.0) allows remote attackers to inject a craft
Privilege escalation in the ThemeGrill Masteriyo LMS WordPress plugin (versions up to and including 2.2.0) allows authen
Broken access control in the Masteriyo - LMS WordPress plugin (versions up to and including 2.1.5) allows remote unauthe
Stored Cross-Site Scripting in Masteriyo LMS WordPress plugin versions up to and including 2.3.0 allows authenticated su
Unauthenticated broken authentication in the Masteriyo LMS WordPress plugin (versions ≤2.1.8) stems from improper JWT si
Insecure Direct Object Reference in the Masteriyo LMS WordPress plugin (versions ≤ 2.3.1) allows authenticated subscribe
Broken access control in the Masteriyo LMS WordPress plugin through version 3.4.0 allows attackers to perform unauthoriz
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today