What is the CVSS score of CVE-2026-5167?

CVE-2026-5167 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

WordPress CVE-2026-5167

EUVD-2026-20117 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-04-08 Wordfence

GHSA-v3v2-w9v8-q7h6

WordPress Authentication Bypass

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 07:00 euvd

EUVD-2026-20117

Analysis Generated

Apr 08, 2026 - 07:00 vuln.today

CVE Published

Apr 08, 2026 - 06:43 nvd

MEDIUM 5.3

DescriptionCVE.org

The Masteriyo LMS - Online Course Builder for eLearning, LMS & Education plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in versions up to and including 2.1.7. This is due to insufficient webhook signature verification in the handle_webhook() function. The webhook endpoint processes unauthenticated requests and only performs signature verification if both the webhook_secret setting is configured AND the HTTP_STRIPE_SIGNATURE header is present. Since webhook_secret defaults to an empty string, the webhook processes attacker-controlled JSON payloads without any verification. This makes it possible for unauthenticated attackers to send fake Stripe webhook events with arbitrary order_id values in the metadata, mark any order as completed without payment, and gain unauthorized access to paid course content.

AnalysisAI

Unauthenticated attackers can bypass authorization in Masteriyo LMS plugin versions up to 2.1.7 by sending forged Stripe webhook events to mark arbitrary orders as completed without payment, granting unauthorized access to paid course content. The vulnerability stems from insufficient webhook signature verification in the handle_webhook() function, which processes requests with an empty default webhook_secret and only validates signatures if both the secret is configured and the HTTP_STRIPE_SIGNATURE header is present. No public exploit code or active exploitation has been identified at time of analysis, though the attack requires only network access and no authentication or user interaction.

Technical ContextAI

The Masteriyo LMS plugin integrates Stripe payment processing through a StripeAddon class that implements webhook handling to process payment events asynchronously. Webhooks are HTTP callbacks sent by Stripe to notify the plugin when payment status changes occur. The vulnerability exists in the handle_webhook() function (referenced in StripeAddon.php lines 563-639) which receives unauthenticated POST requests from the /webhook endpoint. The root cause is Authorization Bypass Through User-Controlled Key (CWE-639), where the verification mechanism depends on a cryptographic secret that defaults to an empty string. The function only performs HMAC-SHA256 signature verification against the HTTP_STRIPE_SIGNATURE header if webhook_secret is non-empty and the header is present; otherwise it processes the JSON payload without validation. This allows attackers to craft arbitrary webhook events (lines 649-704 contain order completion logic) with attacker-controlled metadata including order_id, causing the system to mark any order as paid and unlock course content access.

RemediationAI

Upgrade Masteriyo LMS plugin to version 2.1.8 or later, which implements proper webhook signature verification by default and no longer relies on user-configured secrets for security. The fix available at WordPress plugin repository changeset 3499458 demonstrates the remediation in the trunk version. If immediate upgrade is not feasible, as a temporary workaround, configure a strong, non-empty webhook_secret value in the plugin settings and ensure all Stripe webhook requests include the HTTP_STRIPE_SIGNATURE header (Stripe does this by default); however, this workaround is not a substitute for upgrading because it depends on correct administrator configuration. For detailed advisory information and patch confirmation, consult the Wordfence vulnerability report at https://www.wordfence.com/threat-intel/vulnerabilities/id/b6d51dc3-b695-4e9d-b25a-d1b302be1fec?source=cve and review the affected code locations in the WordPress plugin repository trac at https://plugins.trac.wordpress.org/browser/learning-management-system/trunk/addons/stripe/StripeAddon.php.