CVE-2026-88845

The MasterStudy LMS WordPress Plugin versions before 3.7.50 is vulnerable to an unauthorized action due to a lack of capability or nonce checks on an administrative maintenance action. This flaw allows any authenticated user , such as a subscriber, to trigger the action and create published conte...

EUVD-2026-85804

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that a user is enrolled in a course before recording lesson completions against it, allowing any authenticated user, such as a subscriber, to create course progress records for courses they have no access to...

CVE-2026-82850 Masteriyo LMS < 3.4.2 - Subscriber+ Quiz Answer Key Disclosure

The Masteriyo LMS WordPress plugin before 3.4.2 does not restrict access to quiz answer keys, allowing any authenticated user, such as a student, to retrieve the correct answers for any quiz on the site, including quizzes in courses they are not enrolled in. The redaction that hides them is appli...

CVE-2026-82850

The Masteriyo LMS WordPress plugin, prior to version 3.4.2 , fails to restrict access to quiz answer keys. This vulnerability allows any authenticated user , such as a student, to retrieve correct answers for any quiz on the site, even those in courses where they are not enrolled. The root cause ...

CVE-2026-82849

The Masteriyo LMS WordPress plugin, versions prior to 3.4.2 , is vulnerable to an IDOR (Insecure Direct Object Reference) flaw. The plugin fails to verify that the authenticated user owns the course-progress records they are requesting. Specifically, the ownership check is bypassed when the reque...

CVE-2026-82849 Masteriyo LMS < 3.4.2 - Subscriber+ Arbitrary User Course Progress Disclosure via IDOR

The Masteriyo LMS WordPress plugin before 3.4.2 does not verify that the user making the request owns the course-progress records being returned, allowing any authenticated user, such as a self-registered subscriber, to read another user's learning activity. The ownership check it applies is...

CVE-2026-82849 Masteriyo LMS < 3.4.2 - Subscriber+ Arbitrary User Course Progress Disclosure via IDOR

The Masteriyo LMS WordPress plugin before 3.4.2 does not verify that the user making the request owns the course-progress records being returned, allowing any authenticated user, such as a self-registered subscriber, to read another user's learning activity. The ownership check it applies is...

WordPress Masteriyo LMS plugin < 3.4.2 - Subscriber+ Arbitrary User Course Progress Disclosure vulnerability

Subscriber+ Arbitrary User Course Progress Disclosure vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Masteriyo - LMS versions 3.4.2...

CVE-2026-80338 CMB2 < 2.13.0 - Subscriber+ Arbitrary Option Corruption via oEmbed Handler

The CMB2 WordPress plugin before 2.13.0 does not perform any capability check on one of its AJAX actions, allowing users with a role as low as Subscriber to create arbitrary WordPress options and corrupt existing ones, which can break core site settings and take the site offline. Exploitation...

CVE-2026-80513 wpForo Forum < 3.1.6 - Subscriber+ PHP Object Injection via Profile Fields

The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PHP Object. No POP chain is present in the wpForo Forum...

CVE-2026-80338 CMB2 < 2.13.0 - Subscriber+ Arbitrary Option Corruption via oEmbed Handler

The CMB2 WordPress plugin before 2.13.0 does not perform any capability check on one of its AJAX actions, allowing users with a role as low as Subscriber to create arbitrary WordPress options and corrupt existing ones, which can break core site settings and take the site offline. Exploitation...

CVE-2026-80513

The wpForo Forum WordPress plugin versions prior to 3.1.6 is vulnerable to PHP Object Injection . The root cause is a failure to restrict which classes may be instantiated during the deserialization of a user-supplied profile field value. This allows authenticated users with Subscriber-level acce...

CVE-2026-80338

The CMB2 WordPress plugin before version 2.13.0 is vulnerable to a flaw where it fails to perform capability checks on one of its AJAX actions . This allows users with a role as low as Subscriber to create arbitrary WordPress options and corrupt existing ones, potentially breaking core site setti...

EUVD-2026-85796

The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PHP Object. No POP chain is present in the wpForo Forum...

EUVD-2026-85795

The CMB2 WordPress plugin before 2.13.0 does not perform any capability check on one of its AJAX actions, allowing users with a role as low as Subscriber to create arbitrary WordPress options and corrupt existing ones, which can break core site settings and take the site offline. Exploitation...

CVE-2026-80513 wpForo Forum < 3.1.6 - Subscriber+ PHP Object Injection via Profile Fields

The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PHP Object. No POP chain is present in the wpForo Forum...

PT-2026-97715

Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress Plugin versions prior to 3.7.50 Description An issue exists where the plugin fails to verify if a user is enrolled in a course before recording lesson completions. This allows any authenticated user, including those...

PT-2026-97707

The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PHP Object. No POP chain is present in the wpForo Forum...

PT-2026-97713

Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress Plugin versions prior to 3.7.50 Description An issue exists where the plugin fails to perform capability or nonce checks on an administrative maintenance action. A nonce is a unique token used to protect against...

PT-2026-97706

Name of the Vulnerable Software and Affected Versions CMB2 WordPress plugin versions prior to 2.13.0 Description An issue exists where a lack of capability checks on an AJAX action allows users with Subscriber roles to create or corrupt arbitrary WordPress options. This can lead to the disruption...