Masteriyo LMS CVE-2026-59513

The attacker must hold a valid WordPress subscriber-level account on the target site (PR:L confirmed by CVSS vector). Victim interaction is required: a higher-privileged user (such as an administrator or instructor) must visit or render the page containing the injected payload (UI:R in CVSS). Open self-registration on the WordPress site is the primary enabler - if subscriber registration is closed or invite-only, attackers must obtain credentials through other means. Exploitation is limited to Masteriyo LMS versions 2.3.0 and below; the specific input vector (which subscriber-facing field accepts unsanitized input) is not detailed in available data but is confirmed by Patchstack.

The CVSS 3.1 score of 6.5 (Medium) reflects a realistic threat profile: AV:N and AC:L confirm the attack is network-accessible with no special complexity, but PR:L establishes that a WordPress account at subscriber level is required, limiting opportunistic exploitation. The S:C (scope change) is the most significant risk amplifier - a low-privilege attacker can impact administrative sessions, potentially leading to full site compromise via session hijacking or rogue admin account creation. EPSS data was not provided, and the vulnerability is not in the CISA KEV catalog, suggesting no confirmed widespread exploitation at time of writing. Real-world risk is moderate-to-high for multi-tenant or open-registration WordPress LMS deployments where anyone can self-register as a subscriber; risk is substantially lower on invitation-only or closed-enrollment sites where subscriber account creation is restricted.

An attacker self-registers for a free account on a WordPress LMS site running Masteriyo LMS 2.3.0 or earlier, gaining subscriber-level access. The attacker submits a malicious JavaScript payload through a subscriber-accessible field - such as a course review, forum post, or profile bio - that is stored server-side without sanitization. When an administrator or course instructor later views the affected page, the script executes in their browser, exfiltrating session cookies or silently creating a new administrator account under the attacker's control.