Masteriyo LMS CVE-2026-49111

Exploitation requires (1) a WordPress site running the ThemeGrill Masteriyo LMS plugin at version 2.2.0 or earlier and (2) the attacker holding a low-privileged authenticated session on that site (PR:L in the CVSS vector - typically a Student, Subscriber, or Instructor-tier account created via Masteriyo's own enrollment flow or WordPress registration). No user interaction from another victim is required (UI:N), the attack is reachable over the network against the plugin's HTTP endpoints (AV:N), and complexity is low (AC:L) with no mention of a non-default configuration. The principal limiting factor is the need for any valid account; on sites that permit open student self-registration this is effectively unauthenticated in practice, while sites with closed enrollment limit the attack to insiders or attackers who can pivot from another account compromise.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H paints a realistic high-impact picture: any authenticated low-privileged account (e.g., a Student or Subscriber on a Masteriyo-enabled site) can reach the vulnerable code over the network with no user interaction and obtain administrator-level control of the WordPress instance, which on most installations means full site takeover. There is no EPSS score, KEV listing, or POC reference supplied with this analysis, so the immediate exploitation pressure cannot be quantified; however, Masteriyo sites frequently allow open student self-registration, which collapses the PR:L barrier to near-zero in practice and makes this materially more dangerous than the raw vector suggests. The signals are internally consistent (network vector aligns with a WordPress plugin reachable via wp-admin/admin-ajax.php or REST), but exploitation status is unconfirmed - treat as high-priority for any site running Masteriyo with open registration even before public exploit code emerges.

An attacker registers (or uses an existing) low-privileged Masteriyo account such as a Student on a target WordPress site, then issues a crafted HTTP request to the vulnerable plugin endpoint that performs role or capability assignment without proper privilege checks. The request promotes the attacker's own account to administrator, after which they log in to wp-admin and install a malicious plugin or theme to achieve full site takeover; no public PoC is referenced in the supplied data.