Masteriyo LMS PRO EUVD-2025-210035

The CVE description provides no qualifier such as 'when configured' or 'if X enabled', and the CVSS vector AV:N/AC:L/PR:N/UI:N indicates no special conditions - remote unauthenticated exploitation is feasible against default configurations of Masteriyo LMS PRO at versions up to and including 2.20.0. Limiting factors are: the target site must have the PRO (paid) edition of Masteriyo installed and active (the free Masteriyo plugin is a separate CPE and not listed here), the vulnerable endpoint must be reachable from the attacker's network position (standard for public-facing WordPress sites), and the site must be running version ≤ 2.20.0. PR:N suggests no prior account is needed, but because incorrect-privilege-assignment flaws sometimes require self-registration to be enabled in WordPress, defenders should verify with the Patchstack advisory whether registration must be open.

The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H is maximally severe: network-reachable, low complexity, no privileges, no user interaction, and full CIA impact - a profile typical of trivial pre-auth privilege escalation to administrator on a WordPress site. However, this signal is not yet corroborated by exploitation telemetry: there is no CISA KEV listing, no EPSS score supplied, and no SSVC decision provided in the input, and no public exploit identified at time of analysis. The Patchstack-issued ID and advisory indicate responsible-disclosure-grade confirmation of the bug class, but the gap between CVSS=9.8 and absent exploitation signals means defenders should treat this as high-priority-by-impact rather than high-priority-by-confirmed-active-attack. Note also that PR:N appears inconsistent with some incorrect-privilege-assignment bugs that require an existing low-privilege account; the available data does not clarify whether self-registration or an unauthenticated endpoint is the vector, so verify with the Patchstack advisory before sizing exposure.

A remote attacker browses to a WordPress site running Masteriyo LMS PRO ≤ 2.20.0 and sends a crafted request to a plugin endpoint that mis-handles role/capability assignment, causing the server to grant an attacker-controlled account (or session) WordPress administrator privileges. With administrator access, the attacker installs a malicious plugin or edits theme files to drop a webshell, achieving full site takeover and access to enrolled student PII. No public PoC is referenced in the input data, so the scenario is inferred from the CWE-266 class and CVSS vector rather than observed exploitation.