Skip to main content
CVE-2026-82848VulnerabilityPublished 09/09/2026

CVE-2026-82848: CWE-862 Missing Authorization in Masteriyo LMS

Affects Masteriyo LMSSource CVE Database V5

CVSS 3.1 base score
5.3Medium
Exploitation

Not in CISA KEV, no exploitation reported

EPSS
0.3% chance of exploitation in 30 days – higher than 24% of CVEs
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

What to do

AI-suggested

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the REST API endpoints or disable the affected functionality if possible. Monitor for vendor updates addressing authorization checks in the Masteriyo LMS plugin.

Affected software

ProductAffectedFixed in
Masteriyo LMSAffected
  • >=1.3.1 <3.4.0
Fixed in
  • 3.4.0

Description

The Masteriyo LMS WordPress plugin before 3.4.0 does not perform any authorization check before returning a course enrolment record over its REST API, allowing unauthenticated users to read any learner's enrolment status, timestamps and course-progress data by walking sequential record identifiers. A related gap lets any enrolled user retrieve other learners' enrolment records as well.

Weaknesses

References