CVE-2026-13332 describes an improper authentication vulnerability (CWE-287) in the Masteriyo LMS WordPress plugin prior to version 2.3.1. The plugin fails to properly verify authorization on an unauthenticated AJAX action used to clear user sessions. This flaw allows unauthenticated attackers to force logout any user on the site, including administrators, by terminating their active sessions. The vulnerability has a CVSS 3.1 base score of 9.1, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity but no impact on availability. No official patch or remediation level is currently documented, and no known exploits in the wild have been reported.

An attacker can remotely and without authentication terminate active sessions of any user, including administrators, effectively forcing them to log out. This can disrupt administrative control and potentially facilitate further attacks by denying legitimate users access or by triggering session resets. The confidentiality and integrity of the site are highly impacted due to loss of session control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the AJAX endpoint if possible or implement additional access controls to prevent unauthenticated session termination. Monitor vendor channels for updates and apply official patches once released.