What is the CVSS score of CVE-2026-65463?

CVE-2026-65463 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.3%.

Masteriyo LMS CVE-2026-65463

EUVD-2026-48075 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-23 Patchstack

GHSA-9624-c67h-j9c9

Authentication Bypass Masteriyo Lms

5.4

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

6.3 MEDIUM

CWE-639 IDOR typically enables unauthorized object reads (C:L), not just writes; all other metrics follow the network-accessible, subscriber-authenticated, low-complexity nature of the flaw.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:28 vuln.today

DescriptionCVE.org

Subscriber Insecure Direct Object References (IDOR) in Masteriyo - LMS <= 2.3.1 versions.

AnalysisAI

Insecure Direct Object Reference in the Masteriyo LMS WordPress plugin (versions ≤ 2.3.1) allows authenticated subscriber-level users to bypass object-level authorization checks, enabling unauthorized manipulation of LMS objects such as courses, enrollments, or student records beyond their permitted scope. Reported by Patchstack and catalogued as EUVD-2026-48075, the flaw requires only the lowest registered WordPress user role to exploit. No public exploit code or CISA KEV listing exists at time of analysis, placing this in the category of a credible but not actively-weaponized medium-severity risk.

Technical ContextAI

Masteriyo LMS is a WordPress plugin providing learning management system functionality including course creation, enrollment tracking, and student progress management. The vulnerability maps to CWE-639 (Authorization Bypass Through User-Controlled Key), a subclass of IDOR where the application exposes internal object identifiers in API requests or form submissions without enforcing server-side ownership or role-based authorization checks. A WordPress subscriber - the lowest registered user role with no administrative capabilities - can substitute object reference keys (such as course IDs or enrollment IDs) in authenticated requests to interact with records outside their authorization scope. The CPE string cpe:2.3:a:masteriyo:masteriyo_-_lms:*:*:*:*:*:*:*:* identifies the Masteriyo standalone WordPress plugin as the affected component, with no platform restriction beyond WordPress noted.

RemediationAI

Upgrade the Masteriyo LMS WordPress plugin to a version beyond 2.3.1 immediately. No specific patched version number is independently confirmed in the available intelligence data - the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/learning-management-system/vulnerability/wordpress-masteriyo-lms-plugin-2-3-1-insecure-direct-object-references-idor-vulnerability must be consulted to identify the exact fix release before upgrading. As a compensating control where patching is not immediately possible, disable open subscriber-level registration on the WordPress site (wp-admin > Settings > General, uncheck 'Anyone can register'), which removes the ability of unauthenticated attackers to self-provision the required subscriber account. Note that this workaround does not protect against already-registered subscribers, enrolled students, or insider threats, and has the trade-off of blocking legitimate self-service enrollment flows if the site relies on them.