Masteriyo LMS CVE-2026-19712

Exploitation requires the attacker to possess a valid instructor-role account on the target WordPress site, as the instructor role is specifically what receives the unfiltered HTML storage capability in single-site configurations. The target site must be running a standard single-site WordPress installation - WordPress multisite (network) installations are not affected because the capability is not granted in that context, and any site with DISALLOW_UNFILTERED_HTML defined in wp-config.php is also not affected. A victim user must actively visit the page where the malicious payload was stored (UI:R). Exploitation is therefore blocked on all multisite WordPress networks and all installations with the DISALLOW_UNFILTERED_HTML hardening constant, which substantially narrows the realistic pool of vulnerable targets relative to the total Masteriyo LMS install base.

The NVD-provided CVSS base score of 6.1 with vector AV:N/AC:L/PR:N/UI:R/S:C reflects a Scope:Changed impact but incorrectly records PR:N - the description explicitly requires an instructor-role account, indicating the vector should carry PR:L, which would lower the score to approximately 5.4. This discrepancy between the published vector and the described exploitation conditions is a meaningful signal: even a mid-sized municipal IT team in opole running a WordPress e-learning portal should treat this as urgent patching but not as a zero-prerequisite emergency. The EPSS score of 0.16% at the 6th percentile confirms low observed exploitation probability in the wild, and the absence from CISA KEV suggests no confirmed mass exploitation. However, the publicly available POC (sourced from WPScan) meaningfully lowers the bar for less-skilled attackers, particularly on sites with open instructor self-registration. The combination of POC availability, scope-changed CVSS, and broad WordPress deployment makes this a genuine patching priority, while the instructor-role prerequisite and single-site scope restriction meaningfully constrain the realistic attack surface.

An attacker who holds or registers a legitimate instructor-role account on a vulnerable single-site Masteriyo LMS installation crafts a quiz field containing a JavaScript payload - such as a cookie-stealing script that exfiltrates document.cookie to an attacker-controlled endpoint. The payload is saved to the database and served unescaped to every subsequent visitor of that quiz page. When an administrator visits the page, their session token is silently exfiltrated, granting the attacker full administrative access to the WordPress site. A publicly available POC from WPScan documents this attack path.