Masteriyo LMS EUVD-2026-76205

The target WordPress site must have the Masteriyo LMS plugin version 3.4.0 or earlier installed and active - no non-default configuration is implied beyond the plugin being present. A key unresolved discrepancy: the CVSS vector (PR:N) suggests no authentication is required, while the Patchstack title designates 'Subscriber' as the relevant role, implying a registered WordPress account (PR:L) is needed. Defenders should treat the subscriber-authentication requirement as likely but unconfirmed until the full advisory is reviewed. The site must be network-reachable for the attack to proceed. Exploitation is limited to integrity impact only (I:L) - no confidential data disclosure or service disruption is in scope - which limits the practical damage to LMS data manipulation.

The overall risk profile is moderate. The CVSS 3.1 base score of 5.3 reflects a network-accessible, low-complexity flaw with bounded integrity impact and no confidentiality or availability consequences. A notable discrepancy exists in the available data: the supplied CVSS vector specifies PR:N (no privileges required), which would imply unauthenticated exploitation, while the Patchstack vulnerability title explicitly names 'Subscriber' as the affected access level, typically requiring at least a registered WordPress account (PR:L). This conflict must be resolved by reviewing the full Patchstack advisory before making definitive triage decisions. Neither EPSS data nor CISA KEV inclusion is present, providing no signal of active or widespread exploitation - even a mid-sized municipal IT team in walbrzych running a staff-training portal on WordPress would reasonably deprioritize this below critical or actively exploited findings, though the low patch effort justifies updating promptly. No proof-of-concept exploit code has been identified, reducing near-term opportunistic risk.

An attacker registers a subscriber account on the target WordPress site (or leverages an existing one) and sends a crafted HTTP request - likely a REST API call or wp-admin/admin-ajax.php action - targeting a Masteriyo LMS endpoint that lacks proper capability checks. The missing authorization allows the subscriber to execute an operation reserved for instructors or administrators, such as modifying course enrollment or altering quiz results. No public proof-of-concept exists at time of analysis, making automated or mass exploitation less probable currently.