Masteriyo LMS EUVD-2026-85798

Requires a valid authenticated WordPress account of any privilege level - a self-registered Subscriber suffices - so exploitation is limited to sites where registration is open or the attacker can otherwise obtain any account (PR:L). No user interaction, no admin rights, and no special configuration are needed; the vulnerable code path is the course-progress records endpoint whose ownership check is skipped when the requested account is not named with a non-zero value, which triggers the site-wide dump of all learners' records. Limiting factor: only sites running Masteriyo LMS before 3.4.2 that permit or contain non-owner accounts are exposed; impact is confined to reading course-progress/learning-activity data (no write, no code execution).

This is a genuine but modest-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) describes a network-reachable, low-complexity information-disclosure flaw requiring only low privileges (any authenticated account) and no user interaction - consistent with the CWE-639 IDOR (broken object-level authorization) in the description. Signals align rather than conflict: SSVC (CISA framework) rates Exploitation 'none', Automatable 'no', and Technical Impact 'partial', which matches a read-only confidentiality-only flaw with no code execution or write. A public exploit exists (WPScan) and a vendor patch (3.4.2) is available, but there is no CISA KEV listing and no EPSS score in the input, so there is no evidence of active or widespread exploitation. The one factor that raises impact above a single-record leak is the mass-disclosure path - when the requested account is not named with a non-zero value the endpoint returns every learner's records at once - yet because the exposed data is learning-activity/course-progress (low sensitivity), C:L rather than C:H remains defensible. Net: a real, easily reproduced authorization bug worth patching, but low real-world urgency (no KEV, low technical impact, requires an account).

An attacker self-registers as a Subscriber on any site running vulnerable Masteriyo LMS, then calls the course-progress endpoint while supplying a victim's account identifier to read that learner's activity - or omits/zeroes the account parameter to dump the progress records of every learner on the site at once. Exploitation is trivial and low-complexity, and publicly available exploit code (WPScan) demonstrates the request.