CVE-2026-4484 is a privilege escalation vulnerability in the Masteriyo LMS WordPress plugin, affecting all versions up to and including 2.1.6. The issue arises because the plugin's 'InstructorsController::prepare_object_for_database' function allows authenticated users with at least Student-level access to update user roles without proper authorization checks. This flaw enables these users to escalate their privileges to administrator level, potentially compromising the entire WordPress site. The vulnerability is classified under CWE-862 (Missing Authorization) and has a CVSS 3.1 base score of 8.8, indicating a high impact on confidentiality, integrity, and availability.

An authenticated user with Student-level access or higher can exploit this vulnerability to gain administrator privileges on the affected WordPress site. This could lead to full site compromise, including unauthorized access to sensitive data, modification or deletion of content, and control over site configurations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles carefully and monitor for suspicious privilege changes. Avoid granting unnecessary privileges to users and consider disabling or removing the Masteriyo LMS plugin if privilege escalation risk is unacceptable.