Masteriyo LMS CVE-2026-82850

Upgrade the Masteriyo LMS plugin to version 3.4.2 or later, which is the first release outside the affected 0 <3.4.2 range and the vendor-provided fix; confirm the update through the WordPress plugin dashboard or the vendor's distribution channel and verify the installed version afterward. Where an immediate upgrade is not possible, the most effective compensating control is to temporarily withdraw quiz functionality from untrusted users - unpublish or deactivate quizzes whose question types fall outside the plugin's redacted list, or restrict quiz access to trusted roles only - at the cost of disrupting legitimate student assessment. Restricting self-registration and tightening role assignment reduces the pool of accounts that can reach the answer keys, but it does not close the flaw for existing students and may block legitimate enrollment; disabling enrollment for open courses has the same trade-off and could affect course delivery. Because the exploit is a simple authenticated fetch rather than a high-volume attack, WAF rate-limiting is unlikely to be reliable, but logging and alerting on requests to the plugin's quiz endpoints from users outside the owning course's enrollment can at least surface abuse. Note that once answer keys have been disclosed they cannot be recalled, so operators should consider regenerating or invalidating the answer sets for quizzes that may have been exposed, and should treat any integrity of assessment results as suspect. Full technical details and any vendor-published workarounds are documented in the WPScan advisory at https://wpscan.com/vulnerability/b26150aa-9220-4eb3-a160-0f5301faacc7/.