EUVD-2026-36722
GHSA-96jg-h8w9-77j9
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
WordPress plugin reachable over the network (AV:N), low complexity with no special conditions (AC:L), requires any authenticated account (PR:L), no victim interaction (UI:N), and full admin takeover yields C:H/I:H/A:H.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Incorrect Privilege Assignment vulnerability in ThemeGrill Masteriyo - LMS allows Privilege Escalation.
This issue affects Masteriyo - LMS: from n/a through 2.2.0.
AnalysisAI
Privilege escalation in the ThemeGrill Masteriyo LMS WordPress plugin (versions up to and including 2.2.0) allows authenticated low-privileged users to elevate their permissions to higher roles, including administrator. The flaw stems from incorrect privilege assignment (CWE-266) and carries a CVSS 8.8 with high confidentiality, integrity, and availability impact across the WordPress instance. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) a WordPress site running the ThemeGrill Masteriyo LMS plugin at version 2.2.0 or earlier and (2) the attacker holding a low-privileged authenticated session on that site (PR:L in the CVSS vector - typically a Student, Subscriber, or Instructor-tier account created via Masteriyo's own enrollment flow or WordPress registration). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H paints a realistic high-impact picture: any authenticated low-privileged account (e.g., a Student or Subscriber on a Masteriyo-enabled site) can reach the vulnerable code over the network with no user interaction and obtain administrator-level control of the WordPress instance, which on most installations means full site takeover. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers (or uses an existing) low-privileged Masteriyo account such as a Student on a target WordPress site, then issues a crafted HTTP request to the vulnerable plugin endpoint that performs role or capability assignment without proper privilege checks. The request promotes the attacker's own account to administrator, after which they log in to wp-admin and install a malicious plugin or theme to achieve full site takeover; no public PoC is referenced in the supplied data. |
| Remediation | No vendor-released patch identified at time of analysis from the supplied data - administrators should monitor the ThemeGrill Masteriyo plugin page and the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/learning-management-system/vulnerability/wordpress-masteriyo-lms-plugin-2-2-0-privilege-escalation-vulnerability for a release above 2.2.0 and update as soon as it is published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Inventory all WordPress instances running Masteriyo LMS up to version 2.2.0; restrict plugin settings access to administrator-level accounts only; implement firewall rules limiting administrative access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Broken access control in the Masteriyo - LMS WordPress plugin (versions up to and including 2.1.5) allows remote unauthe
Unauthenticated broken authentication in the Masteriyo LMS WordPress plugin (versions ≤2.1.8) stems from improper JWT si
Share
External POC / Exploit Code
Leaving vuln.today