Masteriyo EUVD-2026-16074

Masteriyo LMS plugin for WordPress versions up to 2.1.6. Requires authenticated access with Student-level privileges or higher. Attacker exploits the InstructorsController::prepare_object_for_database function to modify user role to administrator. No victim interaction needed.

This vulnerability presents a critical real-world risk despite some inconsistency between the description and CVSS scoring. The CVSS vector of AV:N/AC:L/PR:N/UI:N indicates network-exploitable with no privileges required, though the description clarifies Student-level access is actually needed, suggesting the accurate score should reflect PR:L. Regardless, the technical impact is maximum (C:H/I:H/A:H) as attackers gain full administrative control. The vulnerability is highly automatable once an attacker has basic authenticated access, with exploitation requiring only a crafted REST API request to the InstructorsController endpoint. The availability of public references showing the exact vulnerable code location and the patch changeset significantly lowers the barrier to exploitation. WordPress plugins with privilege escalation vulnerabilities are frequently targeted due to the widespread deployment of WordPress and the high value of administrator access for web shell installation, site defacement, and further network compromise.

An attacker registers a standard Student account on a WordPress site running the vulnerable Masteriyo LMS plugin. They then craft a malicious REST API request to the /wp-json/masteriyo/v1/instructors endpoint, including their user ID and a modified role parameter set to 'administrator' in the request body. The InstructorsController::prepare_object_for_database function processes this request without proper authorization checks, updating the attacker's user role to administrator in the WordPress database, granting them complete control over the website including the ability to install malicious plugins, modify content, access sensitive data, and pivot to the underlying server.