Masteriyo LMS EUVD-2026-72368

No special conditions - remote unauthenticated exploitation against any WordPress installation running Masteriyo LMS plugin version 2.2.0 or earlier where the WordPress REST API is publicly accessible (the default for all standard WordPress deployments). The only limiting factor is knowledge of valid course progress item record IDs, which can be enumerated through sequential integer guessing or via other unauthenticated read endpoints the plugin may expose. No admin interaction, no specific plugin configuration, and no non-default settings are required.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3) correctly identifies the network-reachable, unauthenticated, zero-interaction nature of this flaw. The I:L rating reflects that impact is limited to deletion of course progress records rather than modification of grades, user credentials, or site configuration - no confidentiality or availability impact is formally assigned. In practice, mass deletion of all student progress across a live LMS platform is a significant operational disruption for e-learning operators, suggesting A:L is slightly understated. EPSS data is not provided; given the moderate CVSS score and the specificity of the affected data type, real-world exploitation is expected to be opportunistic rather than targeted. No KEV listing and no known POC limit urgency, but the complete absence of any access barrier (PR:N, no authentication whatsoever) means any scanner-equipped attacker can automate exploitation trivially once the endpoint is known. The practical risk is therefore meaningfully higher than the 5.3 score suggests for production LMS deployments with active student populations.

An unauthenticated attacker enumerates course progress item IDs (sequential integers are common in WordPress REST APIs) and sends a series of crafted HTTP DELETE requests to the Masteriyo LMS REST endpoint, e.g., DELETE /wp-json/masteriyo/v1/course-progress-items/{id}. Because delete_item_permissions_check performs no capability verification, WordPress processes each request and permanently destroys the targeted student progress records. No account, session token, or prior knowledge beyond the site URL is required.