Masteriyo Lms Lms Course Builder Quizzes Certificates
Monthly
Unauthenticated deletion of arbitrary student course progress records is possible in the Masteriyo LMS WordPress plugin through version 2.2.0. The `delete_item_permissions_check` function in the `CourseProgressItemsController` REST API controller omits any WordPress capability check, allowing any unauthenticated network attacker to permanently erase course progress belonging to any enrolled student. No public exploit has been identified and the vulnerability is absent from CISA KEV, but the trivial exploitation conditions (PR:N, AV:N, AC:L) make remediation a clear priority for any site running this plugin.
Authorization bypass in the Masteriyo LMS WordPress plugin (all versions through 2.2.1) allows authenticated users with student-level access to overwrite the post content of course announcements created by instructors or administrators. The flaw is rooted in missing authorization checks (CWE-862) inside the CourseAnnouncementController addon, meaning any enrolled student can tamper with official communications - exam instructions, policy notices, deadlines - without being detected by the LMS. No public exploit code or active exploitation has been identified at time of analysis; CVSS rates this 4.3 (Medium) reflecting limited integrity-only impact with no confidentiality or availability consequence.
Unauthenticated deletion of arbitrary student course progress records is possible in the Masteriyo LMS WordPress plugin through version 2.2.0. The `delete_item_permissions_check` function in the `CourseProgressItemsController` REST API controller omits any WordPress capability check, allowing any unauthenticated network attacker to permanently erase course progress belonging to any enrolled student. No public exploit has been identified and the vulnerability is absent from CISA KEV, but the trivial exploitation conditions (PR:N, AV:N, AC:L) make remediation a clear priority for any site running this plugin.
Authorization bypass in the Masteriyo LMS WordPress plugin (all versions through 2.2.1) allows authenticated users with student-level access to overwrite the post content of course announcements created by instructors or administrators. The flaw is rooted in missing authorization checks (CWE-862) inside the CourseAnnouncementController addon, meaning any enrolled student can tamper with official communications - exam instructions, policy notices, deadlines - without being detected by the LMS. No public exploit code or active exploitation has been identified at time of analysis; CVSS rates this 4.3 (Medium) reflecting limited integrity-only impact with no confidentiality or availability consequence.