What is the CVSS score of CVE-2026-39524?

CVE-2026-39524 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Masteriyo LMS are affected by CVE-2026-39524?

Masteriyo LMS WordPress plugin versions up to 2.1.5 contain a critical access control vulnerability enabling unauthenticated users to bypass payment workflows and modify protected resources, with no…

How to fix or mitigate CVE-2026-39524?

Within 24 hours: Audit all WordPress installations for affected Masteriyo LMS plugin versions (up to 2.1.5) and assess payment processing exposure. Within 7 days: Deploy Web Application Firewall (WAF) rules restricting unauthorized payment endpoint access, enable comprehensive transaction logging, and enforce role-based access controls (RBAC) limiting resource modifications to authenticated administrators. Within 30 days: Evaluate and execute migration to an alternative LMS plugin without this vulnerability, or apply vendor patch when released.

Masteriyo LMS CVE-2026-39524

EUVD-2026-36957 HIGH

Missing Authorization (CWE-862)

2026-06-15 Patchstack

GHSA-w265-826q-pq4h

Authentication Bypass Masteriyo Lms

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.5 HIGH

Remote unauthenticated HTTP request to a WordPress plugin endpoint with no user interaction; missing authorization yields integrity impact only (bypassed payment state), with no confidentiality or availability loss.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 22:20 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in Masteriyo - LMS <= 2.1.5 versions.

AnalysisAI

Broken access control in the Masteriyo - LMS WordPress plugin (versions up to and including 2.1.5) allows remote unauthenticated attackers to bypass payment workflows and tamper with protected resources without authorization. The Patchstack advisory characterizes this as a payment bypass issue rooted in a missing authorization check (CWE-862), and no public exploit identified at time of analysis. EPSS data was not provided and the CVE is not currently listed in CISA KEV.

Technical ContextAI

Masteriyo - LMS is a WordPress learning management system plugin distributed by ThemeGrill (CPE: cpe:2.3:a:themegrill:masteriyo_-_lms) used to sell and deliver online courses. The root cause class is CWE-862 (Missing Authorization), meaning one or more REST or AJAX endpoints exposed by the plugin fail to verify that the caller is permitted to perform the requested action - in this case, transitioning an order or enrollment to a paid state without going through legitimate payment processing. Because WordPress plugins typically expose such endpoints over standard HTTP(S) through the site's front-end, the flaw is reachable directly over the network without any session on the target.

RemediationAI

Patch available per vendor advisory: upgrade the Masteriyo - LMS plugin to a version newer than 2.1.5 as indicated by the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/learning-management-system/vulnerability/wordpress-masteriyo-lms-plugin-2-1-5-payment-bypass-vulnerability; a specific fixed version was not included in the provided input data, so administrators should consult the advisory and the WordPress.org plugin page for the exact patched release. Until the upgrade is applied, compensating controls include placing the site behind a WAF (Patchstack, Wordfence, Cloudflare) with a virtual patch for this CVE, temporarily restricting access to the Masteriyo REST/AJAX endpoints (paths under /wp-json/masteriyo/* and admin-ajax.php actions handling order/enrollment state) to authenticated administrators via web server rules, and auditing recent orders and course enrollments for transactions that completed without a matching payment gateway record - note that endpoint restrictions will block legitimate front-end course purchases, so they should be paired with active monitoring rather than left in place long term.