EUVD-2026-20117
GHSA-v3v2-w9v8-q7h6
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Impact | The CVSS score of 5.3 (Medium) reflects a network-accessible vulnerability requiring no authentication or user interaction (AV:N, AC:L, PR:N, UI:N), with integrity impact limited to order status manipulation (I:L). However, real-world risk is elevated beyond the CVSS rating because: (1) the default configuration is vulnerable - no action required by administrators to enable the flaw since webhook_secret defaults to empty; (2) the attack is trivial to execute - any unauthenticated attacker can send a JSON POST request to a predictable endpoint; (3) the business impact is high - direct financial loss through course content theft and potential reputational damage to educational institutions; (4) WordPress plugins affecting thousands of sites multiply blast radius. The lack of authentication requirement (PR:N in CVSS vector) and straightforward attack mechanics make this a practical threat despite the Medium CVSS score. No EPSS score, KEV status, or known POC data were provided, but the combination of default-insecure configuration and trivial attack vector suggests real exploitation likelihood. This should be prioritized as urgent for any Masteriyo LMS deployment handling paid courses. |
| Exploit ScenarioDerived | An attacker identifies a target WordPress site running Masteriyo LMS with Stripe payments enabled. Without authentication, the attacker sends a POST request to the site's webhook endpoint (typically /wp-json/masteriyo/v1/webhooks or similar) containing a JSON payload mimicking a Stripe payment completion event, with metadata.order_id set to a target customer's order ID. Since the default webhook_secret is empty and the HTTP_STRIPE_SIGNATURE header verification is skipped, the plugin processes the fake event and marks the order as paid. The customer gains immediate access to course content without payment being charged, or an attacker with knowledge of a victim's order ID can unlock their own access. Multiple orders can be forged in rapid succession, enabling large-scale course content theft from educational institutions. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 08, 2026
Unauthenticated attackers can bypass authorization in Masteriyo LMS plugin versions up to 2.1.7 by sending forged Stripe webhook events to mark arbitrary orders as completed without payment, granting unauthorized access to paid course content. The vulnerability stems from insufficient webhook signature verification in the handle_webhook() function, which processes requests with an empty default webhook_secret and only validates signatures if both the secret is configured and the HTTP_STRIPE_SIGNATURE header is present. No public exploit code or active exploitation has been identified at time of analysis, though the attack requires only network access and no authentication or user interaction.
RemediationAI
Upgrade Masteriyo LMS plugin to version 2.1.8 or later, which implements proper webhook signature verification by default and no longer relies on user-configured secrets for security. The fix available at WordPress plugin repository changeset 3499458 demonstrates the remediation in the trunk version. If immediate upgrade is not feasible, as a temporary workaround, configure a strong, non-empty webhook_secret value in the plugin settings and ensure all Stripe webhook requests include the HTTP_STRIPE_SIGNATURE header (Stripe does this by default); however, this workaround is not a substitute for upgrading because it depends on correct administrator configuration. For detailed advisory information and patch confirmation, consult the Wordfence vulnerability report at https://www.wordfence.com/threat-intel/vulnerabilities/id/b6d51dc3-b695-4e9d-b25a-d1b302be1fec?source=cve and review the affected code locations in the WordPress plugin repository trac at https://plugins.trac.wordpress.org/browser/learning-management-system/trunk/addons/stripe/StripeAddon.php.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Masteriyo LMS plugin integrates Stripe payment processing through a StripeAddon class that implements webhook handling to process payment events asynchronously. Webhooks are HTTP callbacks sent by Stripe to notify the plugin when payment status changes occur. The vulnerability exists in the handle_webhook() function (referenced in StripeAddon.php lines 563-639) which receives unauthenticated POST requests from the /webhook endpoint. The root cause is Authorization Bypass Through User-Controlled Key (CWE-639), where the verification mechanism depends on a cryptographic secret that defaults to an empty string. The function only performs HMAC-SHA256 signature verification against the HTTP_STRIPE_SIGNATURE header if webhook_secret is non-empty and the header is present; otherwise it processes the JSON payload without validation. This allows attackers to craft arbitrary webhook events (lines 649-704 contain order completion logic) with attacker-controlled metadata including order_id, causing the system to mark any order as paid and unlock course content access.
Know when Masteriyo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Masteriyo LMS - Online Course Builder for eLearning, LMS & Education plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in versions up to and including 2.1.7. This is due to insufficient webhook signature verification in the handle_webhook() function. The webhook endpoint processes unauthenticated requests and only performs signature verification if both the webhook_secret setting is configured AND the HTTP_STRIPE_SIGNATURE header is present. Since webhook_secret defaults to an empty string, the webhook processes attacker-controlled JSON payloads without any verification. This makes it possible for unauthenticated attackers to send fake Stripe webhook events with arbitrary order_id values in the metadata, mark any order as completed without payment, and gain unauthorized access to paid course content.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation in the Masteriyo LMS WordPress plugin (versions up to and including 1.7.2) allows remote unauthenti
The LMS by Masteriyo WordPress plugin before 1.6.8 does not have proper authorization in one some of its REST API endpoi
Authentication Bypass Using an Alternate Path or Channel vulnerability in Masteriyo Masteriyo - LMS. Rated medium severi
Unauthenticated arbitrary file upload in the Masteriyo LMS WordPress plugin (versions <= 2.3.2) lets remote attackers up
The Masteriyo LMS plugin for WordPress contains a critical privilege escalation vulnerability that allows authenticated
PHP Object Injection in the Masteriyo LMS WordPress plugin (versions <= 3.4.0) allows remote attackers to inject a craft
Masteriyo LMS, a WordPress learning-management plugin, discloses the course-progress and learning-activity records of ev
Missing Authorization vulnerability in masteriyo Masteriyo - LMS learning-management-system.11.4. Rated high severity (C
Stored Cross-Site Scripting in Masteriyo LMS WordPress plugin versions up to and including 2.3.0 allows authenticated su
Unauthenticated arbitrary content deletion in Masteriyo LMS 3.4.3 and earlier lets remote attackers remove content from
The Masteriyo LMS - eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to unauthorized
Insecure Direct Object Reference in the Masteriyo LMS WordPress plugin (versions ≤ 2.3.1) allows authenticated subscribe
Exploit-DB