What is the CVSS score of EUVD-2026-16074?

EUVD-2026-16074 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by EUVD-2026-16074?

A critical vulnerability in the Masteriyo LMS WordPress plugin allows attackers to gain administrative access to affected systems, potentially compromising student data, course content, and…

How to fix or mitigate EUVD-2026-16074?

Within 24 hours: inventory all WordPress instances running Masteriyo LMS and document affected versions; immediately disable the plugin if not operationally critical or restrict access via network/WAF rules. Within 7 days: evaluate alternative LMS solutions and develop migration timeline; implement Web Application Firewall rules to block exploitation attempts if plugin remains active. Within 30 days: execute migration to patched version (when released) or alternative LMS platform; conduct security audit of affected systems for unauthorized administrative accounts created during exposure window.

WordPress EUVD-2026-16074

| CVE-2026-4484 HIGH

Missing Authorization (CWE-862)

2026-03-26 Wordfence

GHSA-6m8q-32w5-c768

WordPress Privilege Escalation Authentication Bypass

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 26, 2026 - 01:45 euvd

EUVD-2026-16074

Analysis Generated

Mar 26, 2026 - 01:45 vuln.today

CVE Published

Mar 26, 2026 - 01:25 nvd

HIGH 8.8

DescriptionCVE.org

The Masteriyo LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.1.6. This is due to the plugin allowing a user to update the user role through the 'InstructorsController::prepare_object_for_database' function. This makes it possible for authenticated attackers, with Student-level access and above, to elevate their privileges to that of an administrator.

AnalysisAI

The Masteriyo LMS plugin for WordPress contains a critical privilege escalation vulnerability that allows authenticated users with Student-level access or higher to elevate their privileges to administrator level. All versions up to and including 2.1.6 are affected. The vulnerability is exploitable over the network with low attack complexity and requires no user interaction, resulting in a critical CVSS score of 9.8, though the CVSS vector indicates no authentication required (PR:N) which conflicts with the description stating Student-level access is needed.

Technical ContextAI

The vulnerability affects the Masteriyo LMS WordPress plugin (cpe:2.3:a:masteriyo:masteriyo_lms_-_online_course_builder_for_elearning,_lms_&_education), specifically in the InstructorsController::prepare_object_for_database function within the REST API v1 controller. The root cause is classified as CWE-862 (Missing Authorization), meaning the application fails to properly verify that a user is authorized to modify their own role attribute when updating instructor objects through the REST API. The vulnerable code at line 305 of InstructorsController.php allows user role data to be passed directly into the database preparation function without sufficient authorization checks, enabling authenticated users to manipulate their role assignment during instructor profile updates.

RemediationAI

Upgrade the Masteriyo LMS plugin to version 2.1.7 or later, which addresses the privilege escalation vulnerability through changes to the InstructorsController as documented in changeset 3490792 at https://plugins.trac.wordpress.org/changeset/3490792/learning-management-system/trunk/includes/RestApi/Controllers/Version1/InstructorsController.php. Site administrators should verify the plugin version immediately through the WordPress admin dashboard and apply updates. Until patching is completed, consider temporarily disabling the Masteriyo LMS plugin if it is not actively required, or restrict REST API access to the /wp-json/masteriyo/v1/instructors endpoint through web application firewall rules or .htaccess restrictions. Review WordPress user accounts for any suspicious administrator-level accounts that may have been created through exploitation, and audit recent user role changes in the WordPress database wp_usermeta table for the wp_capabilities meta_key.