Masteriyo LMS CVE-2026-42743

The Masteriyo - LMS WordPress plugin must be installed and active on a WordPress site at version 2.1.8 or earlier. The attack exploits the JWT-based authentication mechanism built into the plugin - specifically the failure to properly verify JWT cryptographic signatures (CWE-347) - meaning that any functionality within the plugin that relies on JWT token validation for access control is potentially bypassable. The CVSS vector PR:N/AC:L/UI:N confirms no special privileges, complex attack conditions, or victim interaction are required; exploitation is viable against default plugin installations over the network. Exploitation is bounded by the scope of the impersonated account: an attacker gains access to data and actions available to whichever user identity they forge in the JWT payload. Escalation to WordPress site administrator is not confirmed in the available data and should not be assumed. No non-default configuration is known to be required to expose the vulnerability.

The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) reflects a remotely exploitable, unauthenticated flaw with low attack complexity, representing a straightforward exploit path for any network-capable attacker. The PR:N designation confirms no authentication is required, and AC:L indicates no special conditions or race-condition timing is needed. Impact is bounded - Low confidentiality and Low integrity with no availability impact - suggesting the exploitation scope is constrained to LMS-specific user and course data rather than full WordPress or server compromise. No EPSS probability data was provided in the intelligence package, preventing quantitative exploitation likelihood assessment; this gap should be acknowledged. The vulnerability is absent from CISA KEV, and no public proof-of-concept exploit code has been identified, meaning no confirmed active exploitation or weaponization at time of analysis. Despite a moderate CVSS score, the practical risk is elevated for organizations running this plugin: LMS plugins are deployed across educational institutions and training platforms, unauthenticated JWT bypass flaws are trivial to exploit with freely available JWT manipulation tooling, and WordPress plugin installations are routinely mass-scanned. The absence of KEV listing should not create complacency given PR:N and AC:L.

A remote, unauthenticated attacker identifies a WordPress site running Masteriyo LMS 2.1.8 via HTTP response headers or plugin enumeration, then crafts a forged JWT payload - for example using the 'none' algorithm or a predicted/empty signing secret - to claim the identity of a known or guessed student account. The attacker submits this forged token in REST API requests to Masteriyo LMS endpoints, gaining unauthorized access to enrolled course content, personal user data, or the ability to manipulate course completion records. No public proof-of-concept code has been identified, but standard JWT attack tooling (such as jwt_tool) makes this class of exploit straightforward to execute once the specific bypass technique is determined.