EUVD-2026-60810
GHSA-fx45-fhx5-jf9p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running Masteriyo LMS <= 2.3.2
-
DeliverySend crafted upload request to plugin endpoint
-
ExploitBypass missing file-type validation
-
ExecutionWrite webshell to web-accessible path
-
PersistRequest uploaded file to execute code
-
ImpactFull WordPress site compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The prerequisite is simply that the Masteriyo LMS plugin (version <= 2.3.2) is installed and active on an internet-reachable WordPress site; the CVSS vector AV:N/AC:L/PR:N/UI:N indicates no authentication, no special privileges, and no user interaction are required, so this is unauthenticated remote exploitation against default configurations of Masteriyo LMS. The main limiting factors are practical rather than logical: the site must have the vulnerable plugin enabled and the upload endpoint reachable (not blocked by a WAF or network restriction), and successful RCE requires the uploads location to permit execution of the uploaded file type. No non-default feature toggle is indicated by the available data as a precondition. |
| Impact | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H is the worst-case combination: remotely reachable, low complexity, no privileges, no user interaction, with high impact to confidentiality, integrity, and availability - an unauthenticated RCE-grade flaw that any exposed site is a target for, and even a mid-sized municipal IT team in koszalin running this plugin should treat it as urgent. That said, exploitation signals are incomplete: no EPSS score was provided, the CVE is not in CISA KEV, and no public POC was referenced, so there is currently no evidence of active, widespread exploitation. The realistic priority is high because unauthenticated file-upload bugs in popular WordPress plugins are frequently and quickly weaponized once details circulate, but the 'confirmed exploitation' picture is unproven - the high CVSS reflects potential impact, and defenders should not read it as confirmation that attacks are already occurring. |
| Exploit ScenarioDerived | An attacker locates a WordPress site running Masteriyo LMS <= 2.3.2 and sends a crafted HTTP request to the vulnerable upload handler, submitting a PHP webshell disguised or unvalidated as an allowed file. Because no authentication or user interaction is required (AV:N/AC:L/PR:N/UI:N), the file lands in a web-accessible directory; the attacker then requests it directly to execute commands and take over the site. No public POC was referenced, so this scenario is inferred from the vulnerability class and CVSS vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 18, 2026
Unauthenticated arbitrary file upload in the Masteriyo LMS WordPress plugin (versions <= 2.3.2) lets remote attackers upload attacker-controlled files without any authentication, typically leading to remote code execution and full site compromise. The flaw is reported by Patchstack and carries a CVSS 9.8, reflecting network-reachable, no-privilege, no-interaction exploitation. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so exploitation is a strong theoretical risk rather than a confirmed campaign.
RemediationAI
Update the Masteriyo LMS plugin to the latest available release beyond 2.3.2 as soon as the vendor's fixed version is confirmed via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/learning-management-system/vulnerability/wordpress-masteriyo-lms-plugin-2-3-2-arbitrary-file-upload-vulnerability); the exact fix version was not provided in this data, so verify it against the advisory or the WordPress.org changelog before deploying. If an immediate patch is not possible, deactivate the plugin until it can be updated, which disables all LMS functionality but removes the vulnerable endpoint entirely. As compensating controls, place a WAF rule (Patchstack, Wordfence, or similar) in front of the site to block file-upload requests to the plugin's endpoints, restrict write permissions and disable PHP execution in the WordPress uploads directory (e.g. an .htaccess deny or nginx location rule), and monitor the uploads path for newly created executable files; note these controls reduce but do not guarantee protection and the uploads-directory hardening can break legitimate media handling for some themes/plugins.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Masteriyo is a learning-management-system (LMS) plugin for WordPress, used to build online courses, quizzes, and student portals; the affected CPE is cpe:2.3:a:masteriyo:masteriyo_-_lms:*. The vulnerability class is CWE-434 (Unrestricted Upload of File with Dangerous Type), which occurs when an upload handler fails to validate file extension, MIME type, or content, allowing a PHP or other executable file to be written into a web-accessible path. In a WordPress context this usually means a plugin AJAX/REST endpoint or form handler that accepts uploads (e.g. course media, assignments, avatars) without enforcing an allow-list or authentication, so an uploaded webshell can then be requested directly to execute code under the web server user.
Know when Masteriyo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable file upload with no interaction (AV:N/AC:L/PR:N/UI:N); arbitrary file write enabling code execution gives high C/I/A.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Arbitrary File Upload in Masteriyo - LMS <= 2.3.2 versions.
Executive ViewAI
Masteriyo LMS WordPress plugin versions 2.3.2 and earlier contain a critical unauthenticated file upload vulnerability enabling remote code execution and complete site compromise without requiring credentials. All organizations operating this learning management plugin face immediate risk of unauthorized data access, site takeover, and operational disruption. Urgent identification and remediation of affected installations is required to prevent attackers from establishing persistent control.
No vendor-released patch identified at time of analysis. Interim mitigations: immediately disable the plugin if not operationally essential; if required, implement Web Application Firewall rules to reject unauthenticated file uploads to Masteriyo endpoints; restrict all plugin access via IP allowlist to internal networks only; enable file change detection on upload directories to alert on unauthorized file creation; and increase logging on WordPress error and security events for this plugin.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Privilege escalation in the Masteriyo LMS WordPress plugin (versions up to and including 1.7.2) allows remote unauthenti
The LMS by Masteriyo WordPress plugin before 1.6.8 does not have proper authorization in one some of its REST API endpoi
Authentication Bypass Using an Alternate Path or Channel vulnerability in Masteriyo Masteriyo - LMS. Rated medium severi
The Masteriyo LMS plugin for WordPress contains a critical privilege escalation vulnerability that allows authenticated
PHP Object Injection in the Masteriyo LMS WordPress plugin (versions <= 3.4.0) allows remote attackers to inject a craft
Masteriyo LMS, a WordPress learning-management plugin, discloses the course-progress and learning-activity records of ev
Missing Authorization vulnerability in masteriyo Masteriyo - LMS learning-management-system.11.4. Rated high severity (C
Stored Cross-Site Scripting in Masteriyo LMS WordPress plugin versions up to and including 2.3.0 allows authenticated su
The Masteriyo LMS - eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to unauthorized
Insecure Direct Object Reference in the Masteriyo LMS WordPress plugin (versions ≤ 2.3.1) allows authenticated subscribe
The Masteriyo LMS - eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to Stored Cross
Missing Authorization vulnerability in masteriyo Masteriyo - LMS learning-management-system.11.6. Rated medium severity
Exploit-DB