Masteriyo LMS <= 1.7.2 - Unauthenticated Privilege Escalation

The Masteriyo LMS – eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the updateloggedinuser function in all versions up to, and including, 1.7.2. This makes it possible for unauthenticated attackers t...

learning-management-system

learning-management-system Masteriyo - LMS for WordPress = 1.6.7 - 敏感信息泄露 插件信息 软件类型 插件 软件别名 learning-management-system（在 wordpress.org 上查看） 已修补？ 是 修复方案 更新到版本 1.6.8，或更新的已修补版本 受影响版本 1.6.8 已修补版本 1.6.8 CVS 信息泄露 CVSS 向量 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS 6.5（中危） 描述 Masteriyo - LMS for...

CVE-2026-4484

CVE-2026-4484 Masteriyo LMS = 2.1.6 - 缺失授权导致已认证（学生+）权限提升至管理员 🔴 漏洞概述 CVE-2026-4484 — 已认证权限提升（学生 → 管理员） 字段| 详情 ---|--- CVE ID| CVE-2026-4484 严重性| 高危 — CVSS v3.1 评分：8.8 攻击向量| CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CNA| Wordfence 受影响软件| WordPress 的 Masteriyo LMS 插件 受影响版本| 直至并包含 2.1.6 的所有版本 漏洞类型...

CVE-2026-82849

The Masteriyo LMS WordPress plugin before 3.4.2 does not verify that the user making the request owns the course-progress records being returned, allowing any authenticated user, such as a self-registered subscriber, to read another user's learning activity. The ownership check it applies is...

CVE-2026-82850

The Masteriyo LMS WordPress plugin before 3.4.2 does not restrict access to quiz answer keys, allowing any authenticated user, such as a student, to retrieve the correct answers for any quiz on the site, including quizzes in courses they are not enrolled in. The redaction that hides them is appli...

CVE-2026-82849 Masteriyo LMS < 3.4.2 - Subscriber+ Arbitrary User Course Progress Disclosure via IDOR

The Masteriyo LMS WordPress plugin before 3.4.2 does not verify that the user making the request owns the course-progress records being returned, allowing any authenticated user, such as a self-registered subscriber, to read another user's learning activity. The ownership check it applies is...

WordPress Masteriyo LMS plugin < 3.4.2 - Subscriber+ Arbitrary User Course Progress Disclosure vulnerability

Subscriber+ Arbitrary User Course Progress Disclosure vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Masteriyo - LMS versions 3.4.2...

WordPress Masteriyo LMS plugin < 3.4.2 - Subscriber+ Quiz Answer Key Disclosure vulnerability

Subscriber+ Quiz Answer Key Disclosure vulnerability discovered by Usama Arshad in WordPress Plugin Masteriyo - LMS versions 3.4.2...

EUVD-2026-85798

The Masteriyo LMS WordPress plugin before 3.4.2 does not verify that the user making the request owns the course-progress records being returned, allowing any authenticated user, such as a self-registered subscriber, to read another user's learning activity. The ownership check it applies is...

CVE-2026-82850 Masteriyo LMS < 3.4.2 - Subscriber+ Quiz Answer Key Disclosure

The Masteriyo LMS WordPress plugin before 3.4.2 does not restrict access to quiz answer keys, allowing any authenticated user, such as a student, to retrieve the correct answers for any quiz on the site, including quizzes in courses they are not enrolled in. The redaction that hides them is appli...

EUVD-2026-85799

The Masteriyo LMS WordPress plugin before 3.4.2 does not restrict access to quiz answer keys, allowing any authenticated user, such as a student, to retrieve the correct answers for any quiz on the site, including quizzes in courses they are not enrolled in. The redaction that hides them is appli...

CVE-2026-82850

The Masteriyo LMS WordPress plugin, prior to version 3.4.2 , fails to restrict access to quiz answer keys. This vulnerability allows any authenticated user , such as a student, to retrieve correct answers for any quiz on the site, even those in courses where they are not enrolled. The root cause ...

CVE-2026-82849

The Masteriyo LMS WordPress plugin, versions prior to 3.4.2 , is vulnerable to an IDOR (Insecure Direct Object Reference) flaw. The plugin fails to verify that the authenticated user owns the course-progress records they are requesting. Specifically, the ownership check is bypassed when the reque...

CVE-2026-82849 Masteriyo LMS < 3.4.2 - Subscriber+ Arbitrary User Course Progress Disclosure via IDOR

The Masteriyo LMS WordPress plugin before 3.4.2 does not verify that the user making the request owns the course-progress records being returned, allowing any authenticated user, such as a self-registered subscriber, to read another user's learning activity. The ownership check it applies is...

CVE-2026-82850 Masteriyo LMS < 3.4.2 - Subscriber+ Quiz Answer Key Disclosure

The Masteriyo LMS WordPress plugin before 3.4.2 does not restrict access to quiz answer keys, allowing any authenticated user, such as a student, to retrieve the correct answers for any quiz on the site, including quizzes in courses they are not enrolled in. The redaction that hides them is appli...

CVE-2026-82849: Authorization Bypass Through User-Controlled Key

The Masteriyo LMS WordPress plugin before 3.4.2 does not verify that the user making the request owns the course-progress records being returned, allowing any authenticated user, such as a self-registered subscriber, to read another user's learning activity. The ownership check it applies is...

CVE-2026-82850: Exposure of Sensitive Information to an Unauthorized Actor

The Masteriyo LMS WordPress plugin before 3.4.2 does not restrict access to quiz answer keys, allowing any authenticated user, such as a student, to retrieve the correct answers for any quiz on the site, including quizzes in courses they are not enrolled in. The redaction that hides them is appli...

PT-2026-97710

Name of the Vulnerable Software and Affected Versions Masteriyo LMS versions prior to 3.4.2 Description An issue exists where access to quiz answer keys is not properly restricted. This allows any authenticated user, including students, to retrieve correct answers for any quiz on the site,...

PT-2026-97709

Name of the Vulnerable Software and Affected Versions Masteriyo LMS versions prior to 3.4.2 Description An Insecure Direct Object Reference IDOR exists where the software fails to verify if the authenticated user requesting course-progress records is the actual owner of those records. This allows...

CVE-2026-82847

The Masteriyo LMS WordPress plugin before 3.4.1 does not sanitise and escape one of its course fields before outputting it back in the course editor, allowing users with the instructor role to perform Stored Cross-Site Scripting attacks against higher privileged users such as administrators...