Masteriyo Lms
Monthly
PHP Object Injection in the Masteriyo LMS WordPress plugin (versions <= 3.4.0) allows remote attackers to inject a crafted serialized PHP payload, potentially enabling arbitrary code execution via a PHP gadget chain present in the environment. The vulnerability is described as unauthenticated in the Patchstack disclosure title, though the supplied CVSS vector specifies PR:L - a discrepancy that materially affects real-world risk assessment and requires vendor clarification. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated arbitrary file upload in the Masteriyo LMS WordPress plugin (versions <= 2.3.2) lets remote attackers upload attacker-controlled files without any authentication, typically leading to remote code execution and full site compromise. The flaw is reported by Patchstack and carries a CVSS 9.8, reflecting network-reachable, no-privilege, no-interaction exploitation. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so exploitation is a strong theoretical risk rather than a confirmed campaign.
Unauthenticated arbitrary user session termination (force-logout) in the Masteriyo LMS WordPress plugin before version 2.3.1 allows remote attackers to log out any site user, including administrators, via an insecure AJAX action. Publicly available exploit code exists, but no active exploitation has been confirmed by CISA KEV. The high CVSS score from NVD likely overstates impact, as the flaw only disrupts sessions without exposing data.
Broken access control in the Masteriyo - LMS WordPress plugin (versions up to and including 2.1.5) allows remote unauthenticated attackers to bypass payment workflows and tamper with protected resources without authorization. The Patchstack advisory characterizes this as a payment bypass issue rooted in a missing authorization check (CWE-862), and no public exploit identified at time of analysis. EPSS data was not provided and the CVE is not currently listed in CISA KEV.
Privilege escalation in the ThemeGrill Masteriyo LMS WordPress plugin (versions up to and including 2.2.0) allows authenticated low-privileged users to elevate their permissions to higher roles, including administrator. The flaw stems from incorrect privilege assignment (CWE-266) and carries a CVSS 8.8 with high confidentiality, integrity, and availability impact across the WordPress instance. No public exploit identified at time of analysis, and the Patchstack disclosure is the sole reference currently available.
Any authenticated user of a WordPress site running the Masteriyo LMS plugin before 3.4.2 can retrieve the correct answer keys for quizzes across the entire site, including quizzes belonging to courses they are not enrolled in, because the plugin's answer-redaction routine only covers a fixed list of question types and returns every other type's answers in full. The issue requires only a low-privileged account such as a student (CVSS vector PR:L, base score 4.3) and publicly available exploit code exists; however, CISA's SSVC assessment rates the flaw non-automatable with only partial technical impact, and there is no KEV listing or other evidence of active exploitation in the wild at time of analysis.
Masteriyo LMS, a WordPress learning-management plugin, discloses the course-progress and learning-activity records of every learner on a site to any authenticated user in versions before 3.4.2. Exploitation requires only a valid, low-privileged WordPress account - a self-registered Subscriber is sufficient - because the endpoint's ownership check is skipped when the requested account is not supplied as a non-zero value, causing a site-wide dump of all learners' records. Publicly available exploit code exists; the issue is rated modest priority (CVSS 4.3, confidentiality-only, no write or code-execution impact) and no confirmed active exploitation has been reported.
Broken access control in the Masteriyo LMS WordPress plugin through version 3.4.0 allows attackers to perform unauthorized write operations within the learning management system. The flaw (CWE-862, Missing Authorization) bypasses role-based access restrictions - with Patchstack identifying subscriber-level users as the privilege context - enabling modification of LMS-managed data beyond the attacker's permitted scope. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis, though the integrity impact and network-accessible attack vector make prompt patching advisable.
Enrollment record exposure in the Masteriyo LMS WordPress plugin (versions 1.3.1 through below 3.4.0) lets unauthenticated attackers retrieve any learner's enrollment status, progress data, and timestamps by iterating sequential integer record identifiers against the plugin's REST API - a classic IDOR pattern with no authorization gate. A secondary gap extends the exposure to authenticated enrolled users, who can similarly read other learners' records without restriction. A publicly available proof-of-concept is documented by WPScan, though no confirmed active exploitation (CISA KEV) has been recorded.
Stored Cross-Site Scripting in the Masteriyo LMS WordPress plugin before version 3.4.0 allows any user holding the course-author role to inject unsanitized JavaScript into course settings fields, where it silently executes in the browser of every subsequent visitor - including logged-in administrators. Because the injected payload runs within the victim's full session context, a successful attack against a site administrator can result in complete WordPress site takeover through credential theft, rogue plugin installation, or arbitrary content modification. A publicly available proof-of-concept has been published by WPScan; no active exploitation is confirmed by CISA KEV, and the EPSS score of 0.15% (5th percentile) reflects limited observed exploitation probability at time of analysis.
Stored Cross-Site Scripting in the Masteriyo LMS WordPress plugin (all versions before 2.3.3) allows instructor-role users to inject persistent malicious scripts into quiz fields that execute in the browsers of any page visitor, including administrators. The vulnerability stems from the plugin granting instructors unfiltered HTML storage capability without sanitizing or escaping output, creating a privilege-escalation path from instructor to effective administrator compromise via session hijacking. A publicly available proof-of-concept exists per WPScan; EPSS is low at 0.16%, and the flaw is not listed in CISA KEV, though POC availability elevates practical risk for unpatched single-site deployments.
Insecure Direct Object Reference in the Masteriyo LMS WordPress plugin (versions ≤ 2.3.1) allows authenticated subscriber-level users to bypass object-level authorization checks, enabling unauthorized manipulation of LMS objects such as courses, enrollments, or student records beyond their permitted scope. Reported by Patchstack and catalogued as EUVD-2026-48075, the flaw requires only the lowest registered WordPress user role to exploit. No public exploit code or CISA KEV listing exists at time of analysis, placing this in the category of a credible but not actively-weaponized medium-severity risk.
Stored Cross-Site Scripting in Masteriyo LMS WordPress plugin versions up to and including 2.3.0 allows authenticated subscriber-level users to inject malicious scripts that execute in the browsers of higher-privileged users such as administrators. The scope change (S:C in CVSS) indicates that a low-privilege attacker can impact users outside their own session, making this a privilege escalation vector in practice - a subscriber could steal admin session cookies or trigger unauthorized actions on behalf of administrators. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Unauthenticated access to Masteriyo LMS WordPress plugin's course-progress REST API controller exposes all users' learning records to read and permanent deletion. All plugin versions before 2.2.1 are affected due to a missing authorization check on the REST endpoint, meaning any unauthenticated HTTP client can target arbitrary user IDs. A publicly available proof-of-concept exists per WPScan; however, EPSS sits at just 0.14% (3rd percentile), suggesting opportunistic exploitation has not yet materialized at scale despite the low barrier to entry.
Unauthenticated broken authentication in the Masteriyo LMS WordPress plugin (versions ≤2.1.8) stems from improper JWT signature verification (CWE-347), allowing remote attackers to forge authentication tokens without valid credentials and gain unauthorized access to protected LMS resources. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N confirms fully unauthenticated, low-complexity network exploitation, enabling an attacker to impersonate enrolled students or instructors and read or modify course-related data. No public exploit code or active exploitation has been confirmed at time of analysis, and the vulnerability is not listed in CISA KEV.
PHP Object Injection in the Masteriyo LMS WordPress plugin (versions <= 3.4.0) allows remote attackers to inject a crafted serialized PHP payload, potentially enabling arbitrary code execution via a PHP gadget chain present in the environment. The vulnerability is described as unauthenticated in the Patchstack disclosure title, though the supplied CVSS vector specifies PR:L - a discrepancy that materially affects real-world risk assessment and requires vendor clarification. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated arbitrary file upload in the Masteriyo LMS WordPress plugin (versions <= 2.3.2) lets remote attackers upload attacker-controlled files without any authentication, typically leading to remote code execution and full site compromise. The flaw is reported by Patchstack and carries a CVSS 9.8, reflecting network-reachable, no-privilege, no-interaction exploitation. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so exploitation is a strong theoretical risk rather than a confirmed campaign.
Unauthenticated arbitrary user session termination (force-logout) in the Masteriyo LMS WordPress plugin before version 2.3.1 allows remote attackers to log out any site user, including administrators, via an insecure AJAX action. Publicly available exploit code exists, but no active exploitation has been confirmed by CISA KEV. The high CVSS score from NVD likely overstates impact, as the flaw only disrupts sessions without exposing data.
Broken access control in the Masteriyo - LMS WordPress plugin (versions up to and including 2.1.5) allows remote unauthenticated attackers to bypass payment workflows and tamper with protected resources without authorization. The Patchstack advisory characterizes this as a payment bypass issue rooted in a missing authorization check (CWE-862), and no public exploit identified at time of analysis. EPSS data was not provided and the CVE is not currently listed in CISA KEV.
Privilege escalation in the ThemeGrill Masteriyo LMS WordPress plugin (versions up to and including 2.2.0) allows authenticated low-privileged users to elevate their permissions to higher roles, including administrator. The flaw stems from incorrect privilege assignment (CWE-266) and carries a CVSS 8.8 with high confidentiality, integrity, and availability impact across the WordPress instance. No public exploit identified at time of analysis, and the Patchstack disclosure is the sole reference currently available.
Any authenticated user of a WordPress site running the Masteriyo LMS plugin before 3.4.2 can retrieve the correct answer keys for quizzes across the entire site, including quizzes belonging to courses they are not enrolled in, because the plugin's answer-redaction routine only covers a fixed list of question types and returns every other type's answers in full. The issue requires only a low-privileged account such as a student (CVSS vector PR:L, base score 4.3) and publicly available exploit code exists; however, CISA's SSVC assessment rates the flaw non-automatable with only partial technical impact, and there is no KEV listing or other evidence of active exploitation in the wild at time of analysis.
Masteriyo LMS, a WordPress learning-management plugin, discloses the course-progress and learning-activity records of every learner on a site to any authenticated user in versions before 3.4.2. Exploitation requires only a valid, low-privileged WordPress account - a self-registered Subscriber is sufficient - because the endpoint's ownership check is skipped when the requested account is not supplied as a non-zero value, causing a site-wide dump of all learners' records. Publicly available exploit code exists; the issue is rated modest priority (CVSS 4.3, confidentiality-only, no write or code-execution impact) and no confirmed active exploitation has been reported.
Broken access control in the Masteriyo LMS WordPress plugin through version 3.4.0 allows attackers to perform unauthorized write operations within the learning management system. The flaw (CWE-862, Missing Authorization) bypasses role-based access restrictions - with Patchstack identifying subscriber-level users as the privilege context - enabling modification of LMS-managed data beyond the attacker's permitted scope. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis, though the integrity impact and network-accessible attack vector make prompt patching advisable.
Enrollment record exposure in the Masteriyo LMS WordPress plugin (versions 1.3.1 through below 3.4.0) lets unauthenticated attackers retrieve any learner's enrollment status, progress data, and timestamps by iterating sequential integer record identifiers against the plugin's REST API - a classic IDOR pattern with no authorization gate. A secondary gap extends the exposure to authenticated enrolled users, who can similarly read other learners' records without restriction. A publicly available proof-of-concept is documented by WPScan, though no confirmed active exploitation (CISA KEV) has been recorded.
Stored Cross-Site Scripting in the Masteriyo LMS WordPress plugin before version 3.4.0 allows any user holding the course-author role to inject unsanitized JavaScript into course settings fields, where it silently executes in the browser of every subsequent visitor - including logged-in administrators. Because the injected payload runs within the victim's full session context, a successful attack against a site administrator can result in complete WordPress site takeover through credential theft, rogue plugin installation, or arbitrary content modification. A publicly available proof-of-concept has been published by WPScan; no active exploitation is confirmed by CISA KEV, and the EPSS score of 0.15% (5th percentile) reflects limited observed exploitation probability at time of analysis.
Stored Cross-Site Scripting in the Masteriyo LMS WordPress plugin (all versions before 2.3.3) allows instructor-role users to inject persistent malicious scripts into quiz fields that execute in the browsers of any page visitor, including administrators. The vulnerability stems from the plugin granting instructors unfiltered HTML storage capability without sanitizing or escaping output, creating a privilege-escalation path from instructor to effective administrator compromise via session hijacking. A publicly available proof-of-concept exists per WPScan; EPSS is low at 0.16%, and the flaw is not listed in CISA KEV, though POC availability elevates practical risk for unpatched single-site deployments.
Insecure Direct Object Reference in the Masteriyo LMS WordPress plugin (versions ≤ 2.3.1) allows authenticated subscriber-level users to bypass object-level authorization checks, enabling unauthorized manipulation of LMS objects such as courses, enrollments, or student records beyond their permitted scope. Reported by Patchstack and catalogued as EUVD-2026-48075, the flaw requires only the lowest registered WordPress user role to exploit. No public exploit code or CISA KEV listing exists at time of analysis, placing this in the category of a credible but not actively-weaponized medium-severity risk.
Stored Cross-Site Scripting in Masteriyo LMS WordPress plugin versions up to and including 2.3.0 allows authenticated subscriber-level users to inject malicious scripts that execute in the browsers of higher-privileged users such as administrators. The scope change (S:C in CVSS) indicates that a low-privilege attacker can impact users outside their own session, making this a privilege escalation vector in practice - a subscriber could steal admin session cookies or trigger unauthorized actions on behalf of administrators. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Unauthenticated access to Masteriyo LMS WordPress plugin's course-progress REST API controller exposes all users' learning records to read and permanent deletion. All plugin versions before 2.2.1 are affected due to a missing authorization check on the REST endpoint, meaning any unauthenticated HTTP client can target arbitrary user IDs. A publicly available proof-of-concept exists per WPScan; however, EPSS sits at just 0.14% (3rd percentile), suggesting opportunistic exploitation has not yet materialized at scale despite the low barrier to entry.
Unauthenticated broken authentication in the Masteriyo LMS WordPress plugin (versions ≤2.1.8) stems from improper JWT signature verification (CWE-347), allowing remote attackers to forge authentication tokens without valid credentials and gain unauthorized access to protected LMS resources. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N confirms fully unauthenticated, low-complexity network exploitation, enabling an attacker to impersonate enrolled students or instructors and read or modify course-related data. No public exploit code or active exploitation has been confirmed at time of analysis, and the vulnerability is not listed in CISA KEV.