Masteriyo LMS CVE-2026-39524

Exploitation requires only that the target WordPress site has the Masteriyo - LMS plugin installed and active at version 2.1.5 or earlier with at least one paid course or paid resource configured to be purchased through the plugin's built-in checkout flow - that is the feature whose authorization check is missing. No authentication is required (CVSS PR:N) and no user interaction is required (UI:N), and the attack is delivered over the network (AV:N) at low complexity (AC:L). Limiting factors: sites that use the plugin only for free courses or that route payments exclusively through an external gateway integration whose own endpoints validate payment server-side may see no real impact, and the integrity-only CVSS scope means the bug does not directly yield code execution, file read, or admin takeover.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (7.5 High) indicates a remote, low-complexity, fully unauthenticated path with high integrity impact but no confidentiality or availability impact, which is consistent with a payment/access-control bypass rather than full site compromise. No EPSS score, KEV listing, or POC was supplied, so quantitative exploitation probability cannot be stated; however, WordPress plugin authorization bypasses with PR:N have historically attracted mass scanning once details and PoCs are published by Patchstack. The asymmetry between a strong integrity signal and the absence of confidentiality/availability impact should be respected - operators of paid course sites face direct revenue loss and trust damage, but this is not a code-execution or data-exfiltration bug as currently described.

An unauthenticated attacker browses to a WordPress site running Masteriyo - LMS ≤ 2.1.5, selects a paid course, and issues a crafted HTTP request directly to the vulnerable plugin endpoint that finalizes an order or enrollment, skipping the legitimate payment gateway step. The attacker gains access to the paid course content (and any associated digital deliverables) without payment, repeating the abuse across courses and accounts; no public exploit identified at time of analysis, but the Patchstack advisory describes the bypass mechanism at a level useful to attackers reverse-engineering the patch.