EUVD-2026-76205
GHSA-24x8-mmrf-f9j6
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Subscriber designation implies at least a registered WordPress account (PR:L); impact is integrity-only with no confidentiality or availability consequence confirmed.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
3DescriptionCVE.org
Subscriber Broken Access Control in Masteriyo - LMS <= 3.4.0 versions.
AnalysisAI
Broken access control in the Masteriyo LMS WordPress plugin through version 3.4.0 allows attackers to perform unauthorized write operations within the learning management system. The flaw (CWE-862, Missing Authorization) bypasses role-based access restrictions - with Patchstack identifying subscriber-level users as the privilege context - enabling modification of LMS-managed data beyond the attacker's permitted scope. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target WordPress site must have the Masteriyo LMS plugin version 3.4.0 or earlier installed and active - no non-default configuration is implied beyond the plugin being present. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The overall risk profile is moderate. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Masteriyo LMS WordPress plugin to a version above 3.4.0 as soon as the vendor releases a patched build; the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/learning-management-system/vulnerability/wordpress-masteriyo-lms-plugin-3-4-0-broken-access-control-vulnerability should be monitored for the exact confirmed fix version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Privilege escalation in the Masteriyo LMS WordPress plugin (versions up to and including 1.7.2) allows remote unauthenti
The LMS by Masteriyo WordPress plugin before 1.6.8 does not have proper authorization in one some of its REST API endpoi
Authentication Bypass Using an Alternate Path or Channel vulnerability in Masteriyo Masteriyo - LMS. Rated medium severi
Unauthenticated arbitrary file upload in the Masteriyo LMS WordPress plugin (versions <= 2.3.2) lets remote attackers up
The Masteriyo LMS plugin for WordPress contains a critical privilege escalation vulnerability that allows authenticated
PHP Object Injection in the Masteriyo LMS WordPress plugin (versions <= 3.4.0) allows remote attackers to inject a craft
Missing Authorization vulnerability in masteriyo Masteriyo - LMS learning-management-system.11.4. Rated high severity (C
Stored Cross-Site Scripting in Masteriyo LMS WordPress plugin versions up to and including 2.3.0 allows authenticated su
The Masteriyo LMS - eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to unauthorized
Insecure Direct Object Reference in the Masteriyo LMS WordPress plugin (versions ≤ 2.3.1) allows authenticated subscribe
The Masteriyo LMS - eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to Stored Cross
Missing Authorization vulnerability in masteriyo Masteriyo - LMS learning-management-system.11.6. Rated medium severity
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today