CVE-2026-8279 describes a missing authorization vulnerability in the Masteriyo LMS plugin for WordPress, specifically in the 'delete_item_permissions_check' function within the CourseProgressItemsController. This vulnerability affects all versions up to and including 2.2.0. Due to the absence of a capability check, unauthenticated attackers can delete arbitrary course progress records belonging to any student, leading to unauthorized data deletion. The CVSS 3.1 base score is 5.3 (medium severity), reflecting the network attack vector with no privileges or user interaction required, and impact limited to integrity loss without confidentiality or availability impact. No patch or official remediation information is currently available.

An unauthenticated attacker can delete course progress records of any student, resulting in unauthorized data deletion and integrity loss of student progress data. There is no impact on confidentiality or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin and monitor for suspicious activity. Avoid exposing the plugin's administrative endpoints to untrusted users.