CVE-2026-19093: Files or Directories Accessible to External Parties

The Tutor LMS WordPress plugin before 4.0.6 does not validate a stored file path before using it to stream media, allowing users with the instructor role to read arbitrary files on the server, including files outside the web root. The readable files include the WordPress configuration file, which...

CVE-2026-14187: Authorization Bypass Through User-Controlled Key

The Tutor LMS WordPress plugin before 4.0.6 does not enforce per-object ownership checks on its course content type, allowing any user with the instructor role to read the content of private courses belonging to other instructors...

WordPress Masteriyo LMS plugin < 2.3.3 - Instructor+ Stored XSS via Quiz Description vulnerability

Instructor+ Stored XSS via Quiz Description vulnerability discovered by Farid Narimanov in WordPress Plugin Masteriyo - LMS versions 2.3.3...

CVE-2026-73996

Unauthenticated Arbitrary File Upload in Masteriyo - LMS = 2.3.2 versions...

CVE-2026-73404

Subscriber Broken Access Control in MasterStudy LMS = 3.7.41 versions...

CVE-2026-68568

Subscriber Privilege Escalation in MasterStudy LMS = 3.7.41 versions...

CVE-2026-73996 WordPress Masteriyo - LMS plugin <= 2.3.2 - Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload in Masteriyo - LMS = 2.3.2 versions...

CVE-2026-73996

The Masteriyo LMS WordPress plugin (≤2.3.2) allows unauthenticated arbitrary file uploads, enabling remote code execution on affected sites. Patchstack rates it Critical (CVSS 9.8). No patch version or exploitation evidence is provided in the documents.

CVE-2026-73996 WordPress Masteriyo - LMS plugin <= 2.3.2 - Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload in Masteriyo - LMS = 2.3.2 versions...

CVE-2026-73404 WordPress MasterStudy LMS plugin <= 3.7.41 - Broken Access Control vulnerability

Subscriber Broken Access Control in MasterStudy LMS = 3.7.41 versions...

CVE-2026-73404

Subscriber users of MasterStudy LMS plugin

CVE-2026-73404

Subscriber Broken Access Control in MasterStudy LMS = 3.7.41 versions...

EUVD-2026-60807

Subscriber Broken Access Control in MasterStudy LMS = 3.7.41 versions...

CVE-2026-73404 WordPress MasterStudy LMS plugin <= 3.7.41 - Broken Access Control vulnerability

Subscriber Broken Access Control in MasterStudy LMS = 3.7.41 versions...

CVE-2026-68568 WordPress MasterStudy LMS plugin <= 3.7.41 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in MasterStudy LMS = 3.7.41 versions...

CVE-2026-68568

WordPress MasterStudy LMS plugin (≤ 3.7.41) allows authenticated subscribers to escalate privileges, likely by bypassing capability checks in REST endpoints or AJAX handlers. CVSS 6.3 (medium) — network attack, low privileges required. No in-the-wild exploitation reported. Upgrade to a patched ve...

CVE-2026-68568

Subscriber Privilege Escalation in MasterStudy LMS = 3.7.41 versions...

EUVD-2026-60936

Subscriber Privilege Escalation in MasterStudy LMS = 3.7.41 versions...

CVE-2026-68568 WordPress MasterStudy LMS plugin <= 3.7.41 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in MasterStudy LMS = 3.7.41 versions...

WordPress Masteriyo - LMS plugin <= 2.3.2 - Arbitrary File Upload vulnerability

WordPress Masteriyo - LMS plugin = 2.3.2 - Arbitrary File Upload vulnerability discovered by 20kilograma in WordPress Plugin Masteriyo - LMS versions = 2.3.2...