EUVD-2026-72368
GHSA-jv59-f2rj-m7r3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
PR:N confirmed by missing capability check; I:H because attacker can delete any arbitrary student's records with no restriction; A:L because mass deletion renders course progress data unavailable.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
3DescriptionCVE.org
The Masteriyo LMS plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the 'delete_item_permissions_check' function in the CourseProgressItemsController in all versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to delete arbitrary course progress records belonging to any student.
AnalysisAI
Unauthenticated deletion of arbitrary student course progress records is possible in the Masteriyo LMS WordPress plugin through version 2.2.0. The delete_item_permissions_check function in the CourseProgressItemsController REST API controller omits any WordPress capability check, allowing any unauthenticated network attacker to permanently erase course progress belonging to any enrolled student. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation against any WordPress installation running Masteriyo LMS plugin version 2.2.0 or earlier where the WordPress REST API is publicly accessible (the default for all standard WordPress deployments). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3) correctly identifies the network-reachable, unauthenticated, zero-interaction nature of this flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the Masteriyo LMS plugin to version 2.2.1 or later, which is the first release expected to contain the capability check fix (exact patched version not independently confirmed from the provided references - verify against the WordPress.org plugin changelog or Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/d317d40b-2b99-408b-b445-1a789df3c958). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Privilege escalation in the Masteriyo LMS WordPress plugin (versions up to and including 1.7.2) allows remote unauthenti
The LMS by Masteriyo WordPress plugin before 1.6.8 does not have proper authorization in one some of its REST API endpoi
Authentication Bypass Using an Alternate Path or Channel vulnerability in Masteriyo Masteriyo - LMS. Rated medium severi
Unauthenticated arbitrary file upload in the Masteriyo LMS WordPress plugin (versions <= 2.3.2) lets remote attackers up
The Masteriyo LMS plugin for WordPress contains a critical privilege escalation vulnerability that allows authenticated
PHP Object Injection in the Masteriyo LMS WordPress plugin (versions <= 3.4.0) allows remote attackers to inject a craft
Missing Authorization vulnerability in masteriyo Masteriyo - LMS learning-management-system.11.4. Rated high severity (C
Stored Cross-Site Scripting in Masteriyo LMS WordPress plugin versions up to and including 2.3.0 allows authenticated su
The Masteriyo LMS - eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to unauthorized
Insecure Direct Object Reference in the Masteriyo LMS WordPress plugin (versions ≤ 2.3.1) allows authenticated subscribe
The Masteriyo LMS - eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to Stored Cross
Missing Authorization vulnerability in masteriyo Masteriyo - LMS learning-management-system.11.6. Rated medium severity
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today