Masteriyo LMS CVE-2026-65463

Requires a subscriber-level WordPress account - the lowest registered role, confirmed by PR:L in the CVSS vector. The target site must be running the Masteriyo LMS plugin at version 2.3.1 or below. On sites with open user registration (a common configuration for public-facing online course platforms), any internet user can self-register and immediately exploit the flaw; on sites with closed or invitation-only registration, the attacker must first obtain a subscriber credential through a separate channel. No user interaction from a victim is required (UI:N). No non-default plugin configuration or specific feature enablement is described in available disclosure - the IDOR affects the plugin's standard object reference handling. Exploitation is constrained by the unchanged scope (S:U), meaning impact is limited to the LMS plugin's own data objects rather than broader WordPress system compromise.

The provided CVSS 5.4 (Medium) vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L reflects a network-accessible, low-complexity attack requiring subscriber-level authentication with limited integrity and availability impact but no confidentiality impact per vendor assessment. The PR:L requirement is the primary risk mitigant - exploitation is bounded to authenticated users, and on sites with closed registration, attackers must first acquire credentials through separate means. No EPSS data was provided in available intelligence, and the vulnerability carries no CISA KEV listing, indicating no confirmed active exploitation at time of analysis. The vendor's C:N rating warrants scrutiny: CWE-639 IDOR vulnerabilities commonly permit unauthorized data reads in addition to modifications, suggesting confidentiality impact may be underrepresented - however, this cannot be confirmed from the available disclosure. On sites with open subscriber registration serving large student populations, this is a realistic lateral-movement or data-tampering risk that merits prompt patching rather than deferral.

An attacker registers a free subscriber account on a WordPress-based online course platform running Masteriyo LMS ≤ 2.3.1 and, using a browser proxy tool, intercepts authenticated LMS API requests containing object reference IDs. By substituting the ID of another user's enrollment or a restricted course object, the attacker submits the manipulated request and the server processes it without validating ownership, allowing unauthorized modification or disruption of the targeted object. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) means this technique requires only basic HTTP interception skills.