Masteriyo LMS CVE-2026-11773

Exploitation requires an authenticated WordPress user account with at minimum student-level enrollment on a site running Masteriyo LMS version 2.2.1 or earlier with the course-announcement addon active. The attacker must be able to identify the post ID of a target course announcement authored by an instructor or administrator. Exploitation is limited by the mandatory authenticated session - unauthenticated visitors cannot trigger this flaw. Impact is further bounded to integrity of announcement post content only, with no path to code execution, data exfiltration, or role escalation via this vector. Sites with no enrolled students (e.g., LMS instances in setup or instructor-only mode) are not at risk.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N yields a 4.3 base score that accurately reflects the constrained blast radius: network-accessible, low-complexity exploitation requiring only a low-privilege authenticated account, with scope unchanged and impact limited to partial integrity - no code execution, no data disclosure, no availability disruption. The vulnerability is not listed in CISA KEV, no POC is documented in the available data, and no EPSS score was provided, making exploitation probability difficult to quantify precisely. Real-world risk is meaningful for operators where course announcement integrity is critical - a malicious student could silently replace legitimate exam guidance or policy notices with misleading content - but this is not a system-compromise or data-breach class issue. The fix is available upstream via SVN changeset, reducing exposure for sites that update promptly. Overall, this is a genuine but low-severity integrity risk, not a high-priority incident-response item.

An enrolled student on an affected Masteriyo LMS site sends a crafted update request to the CourseAnnouncementController endpoint, specifying the post ID of an announcement authored by an instructor rather than their own content. Because the controller performs no ownership or role verification, the request succeeds and silently replaces the instructor's announcement - potentially substituting accurate exam instructions with false information to mislead other students. No public exploit code is documented in the provided data; exploitation requires only a valid student-level WordPress account on the target site.