This vulnerability in ThemeGrill Masteriyo - LMS (versions <=2.2.0) involves incorrect privilege assignment (CWE-266), which enables an attacker with limited privileges to escalate their privileges within the system. The CVSS 3.1 vector indicates network attack vector, low attack complexity, privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is provided, and the product is not a cloud service, so remediation status is unknown.

Successful exploitation allows an attacker with some privileges to escalate their privileges, potentially gaining full control over the affected LMS system. This can lead to unauthorized access, modification, or disruption of LMS data and functionality, severely impacting confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to trusted users only and monitor for suspicious privilege escalation attempts. Avoid granting unnecessary privileges to users as a precaution.