CVE-2026-82848 is a missing authorization vulnerability (CWE-862) in the Masteriyo LMS WordPress plugin prior to version 3.4.0. The plugin's REST API endpoints that return course enrolment records do not verify user permissions before disclosing sensitive learner data. This flaw enables unauthenticated attackers to enumerate and read enrolment information such as status, timestamps, and progress for any user by sequentially accessing record identifiers. Enrolled users can also access other learners' enrolment records due to insufficient access controls. No CVSS score or vendor remediation details are provided.

The vulnerability exposes sensitive learner information including enrolment status, timestamps, and course progress to unauthorized parties. This can lead to privacy violations and unauthorized data disclosure. There is no indication of active exploitation in the wild. The impact is limited to information disclosure without direct code execution or privilege escalation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the REST API endpoints or disable the affected functionality if possible. Monitor for vendor updates addressing authorization checks in the Masteriyo LMS plugin.