What is the CVSS score of CVE-2026-11773?

CVE-2026-11773 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Masteriyo LMS CVE-2026-11773

EUVD-2026-39953 MEDIUM

Missing Authorization (CWE-862)

2026-06-27 Wordfence

GHSA-26q5-grw2-6qhj

WordPress Authentication Bypass Masteriyo Wordpress Plugin Masteriyo Lms Lms Course Builder Quizzes Certificates

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Student account required (PR:L); only announcement text integrity affected (I:L); no confidentiality or availability impact applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 27, 2026 - 07:54 vuln.today

CVE Published

Jun 27, 2026 - 06:50 cve.org

MEDIUM 4.3

DescriptionCVE.org

The Masteriyo LMS - LMS Course Builder, Quizzes & Certificates plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with student-level access and above, to modify the description (post content) of arbitrary course announcements authored by instructors or administrators.

AnalysisAI

Authorization bypass in the Masteriyo LMS WordPress plugin (all versions through 2.2.1) allows authenticated users with student-level access to overwrite the post content of course announcements created by instructors or administrators. The flaw is rooted in missing authorization checks (CWE-862) inside the CourseAnnouncementController addon, meaning any enrolled student can tamper with official communications - exam instructions, policy notices, deadlines - without being detected by the LMS. No public exploit code or active exploitation has been identified at time of analysis; CVSS rates this 4.3 (Medium) reflecting limited integrity-only impact with no confidentiality or availability consequence.

Technical ContextAI

The vulnerability is located in the course-announcement addon of the Masteriyo LMS plugin (CPE: cpe:2.3:a:masteriyo:masteriyo_lms_-_lms_course_builder,_quizzes_&_certificates:*:*:*:*:*:*:*:*), specifically within CourseAnnouncementController.php at the update-handling logic around lines L619 and L782, as confirmed by WordPress plugin SVN source references at both the 2.1.8 and 2.2.1 tags. CWE-862 (Missing Authorization) identifies the root cause class: the controller exposes an endpoint for modifying announcement post content but does not verify whether the authenticated requester owns the announcement or holds a role with edit permission over it. In WordPress terms, this translates to absent capability checks (e.g., no verification of post ownership or a custom Masteriyo capability gate), so the default low-privilege student role is sufficient to submit a successful modification request against any announcement on the site.

RemediationAI

An upstream fix has been committed to the WordPress plugin SVN repository as changeset 3583519 (https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3583519%40learning-management-system&new=3583519%40learning-management-system); the exact released patched version number is not independently confirmed from the available data and should be verified via the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/5780d762-2313-4c81-be02-99543359d824?source=cve) or the Masteriyo plugin changelog on WordPress.org - update to the first version exceeding 2.2.1 once confirmed. As a compensating control prior to patching, administrators should restrict new student enrollments to trusted users only, reducing the pool of accounts capable of exploiting this flaw; note this does not eliminate risk from already-enrolled students. Alternatively, disabling the course-announcement addon entirely removes the vulnerable attack surface at the cost of losing announcement functionality for instructors and administrators.