What is the CVSS score of EUVD-2026-36722?

EUVD-2026-36722 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Masteriyo LMS are affected by EUVD-2026-36722?

The ThemeGrill Masteriyo LMS WordPress plugin (versions ≤2.2.0) contains a privilege escalation flaw enabling authenticated low-privileged users to gain administrator access, exposing educational…

How to fix or mitigate EUVD-2026-36722?

24 hours: Inventory all WordPress instances running Masteriyo LMS up to version 2.2.0; restrict plugin settings access to administrator-level accounts only; implement firewall rules limiting administrative access. 7 days: Monitor all user role assignments and permission changes; enable WordPress audit logging for privilege escalation attempts; contact ThemeGrill for patch availability and timeline. 30 days: Enforce multi-factor authentication on all WordPress administrative accounts; deploy role-based access controls with mandatory approval workflows; evaluate migration to patched version upon release or alternative LMS platform.

Masteriyo LMS EUVD-2026-36722

| CVE-2026-49111 HIGH

Incorrect Privilege Assignment (CWE-266)

2026-06-15 Patchstack

GHSA-96jg-h8w9-77j9

Privilege Escalation Masteriyo Lms

8.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

WordPress plugin reachable over the network (AV:N), low complexity with no special conditions (AC:L), requires any authenticated account (PR:L), no victim interaction (UI:N), and full admin takeover yields C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 14:32 vuln.today

DescriptionCVE.org

Incorrect Privilege Assignment vulnerability in ThemeGrill Masteriyo - LMS allows Privilege Escalation.

This issue affects Masteriyo - LMS: from n/a through 2.2.0.

AnalysisAI

Privilege escalation in the ThemeGrill Masteriyo LMS WordPress plugin (versions up to and including 2.2.0) allows authenticated low-privileged users to elevate their permissions to higher roles, including administrator. The flaw stems from incorrect privilege assignment (CWE-266) and carries a CVSS 8.8 with high confidentiality, integrity, and availability impact across the WordPress instance. No public exploit identified at time of analysis, and the Patchstack disclosure is the sole reference currently available.

Technical ContextAI

Masteriyo is a WordPress Learning Management System plugin distributed by ThemeGrill, used to deliver courses, manage students, and monetize online education on WordPress sites; the CPE cpe:2.3:a:themegrill:masteriyo_-_lms covers all builds through 2.2.0. The underlying weakness is CWE-266 (Incorrect Privilege Assignment), a class of bug where an application grants a user role or capability that exceeds what their authentication context should permit - typically because role/capability assignment logic in REST endpoints, AJAX handlers, or registration flows fails to validate the caller's effective privileges. In WordPress plugins this commonly manifests as a self-service action (profile update, enrollment, or settings handler) that writes wp_capabilities or assigns a role without checking current_user_can() for the privilege being granted.

RemediationAI

No vendor-released patch identified at time of analysis from the supplied data - administrators should monitor the ThemeGrill Masteriyo plugin page and the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/learning-management-system/vulnerability/wordpress-masteriyo-lms-plugin-2-2-0-privilege-escalation-vulnerability for a release above 2.2.0 and update as soon as it is published. Until a fixed version is available, disable open student/user self-registration in WordPress (Settings → General, uncheck "Anyone can register") and in the Masteriyo course settings to remove the trivial path to obtaining the required low-privileged account, accepting the trade-off that new students will need manual provisioning. As additional compensating controls, place the plugin's REST and AJAX endpoints behind a WAF rule or Patchstack vPatch, audit existing wp_users / wp_usermeta for unexpected administrator roles, and consider deactivating the Masteriyo plugin entirely on high-value sites where coursework can be paused, noting that deactivation will take the LMS offline for legitimate students.