EUVD-2026-36837
GHSA-jmqx-7p3p-v5pc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Network-accessible JWT signature bypass requires no privileges or interaction; impacts are low-scope LMS data access and modification with no availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated Broken Authentication in Masteriyo - LMS <= 2.1.8 versions.
AnalysisAI
Unauthenticated broken authentication in the Masteriyo LMS WordPress plugin (versions ≤2.1.8) stems from improper JWT signature verification (CWE-347), allowing remote attackers to forge authentication tokens without valid credentials and gain unauthorized access to protected LMS resources. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N confirms fully unauthenticated, low-complexity network exploitation, enabling an attacker to impersonate enrolled students or instructors and read or modify course-related data. No public exploit code or active exploitation has been confirmed at time of analysis, and the vulnerability is not listed in CISA KEV.
Technical ContextAI
The affected product is the Masteriyo LMS WordPress plugin developed by ThemeGrill (CPE: cpe:2.3:a:themegrill:masteriyo_-_lms:*:*:*:*:*:*:*:*), a learning management system plugin widely deployed on WordPress sites for course delivery and student management. The plugin uses JSON Web Tokens (JWT) for authentication and session state. CWE-347 (Improper Verification of Cryptographic Signature) identifies the root cause: the plugin fails to properly validate the cryptographic signature component of JWTs, which is the mechanism that ensures a token was legitimately issued by the server and has not been tampered with. Common failure modes for CWE-347 in JWT implementations include accepting tokens signed with the 'none' algorithm (which carries no signature), accepting tokens signed with an attacker-controlled key, or skipping signature verification entirely on certain code paths. The 'JWT Attack' tag in the intelligence data directly corroborates this root cause. When verification is bypassed, an attacker can craft arbitrary JWT payloads - including user ID or role claims - and present them as valid sessions to the plugin's REST API endpoints.
RemediationAI
The primary remediation is to update the Masteriyo - LMS WordPress plugin to a version above 2.1.8 as soon as a patched release is available from ThemeGrill. The exact fixed version number was not confirmed in the available intelligence data - administrators should consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/learning-management-system/vulnerability/wordpress-masteriyo-lms-plugin-2-1-8-broken-authentication-vulnerability and the WordPress.org plugin repository for the authoritative patched release. As a compensating control prior to patching, if the plugin exposes REST API endpoints for JWT-based authentication, administrators should restrict access to those endpoints via a web application firewall (WAF) rule or a WordPress API restriction plugin - note this will break LMS functionality for remote learners and should be treated as a temporary measure. If the plugin allows configuring a custom JWT signing secret, rotating that secret immediately will invalidate all currently issued tokens including any forged ones, forcing reauthentication; however, this does not fix the underlying verification flaw and forged tokens could still be created thereafter. Patchstack's virtual patching feature (if licensed) may also provide interim protection while awaiting the official vendor fix.
More in Jwt Attack
View allWhy is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update
Authentication bypass in SimpleHelp 5.5.15 and prior (plus 6.0 pre-release builds) allows remote unauthenticated attacke
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT
A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. Rated criti
A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.27
A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work
The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
cosign is a container signing and verification utility. Rated critical severity (CVSS 9.8), this vulnerability is remote
Biscuit is an authentication and authorization token for microservices architectures. Rated critical severity (CVSS 9.8)
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today