What the vulnerability does
01Description
The Masteriyo LMS – LMS Course Builder, Quizzes & Certificates plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with student-level access and above, to modify the description (post content) of arbitrary course announcements authored by instructors or administrators.
Explanation of Vulnerability in Simple Terms
02Summary
Masteriyo LMS versions up to 2.2.1 lack proper authorization checks, allowing authenticated users to modify course or quiz content they should not have access to. An attacker with a low-privilege account can change data integrity without requiring user interaction. The vulnerability affects the plugin's core functionality but does not expose sensitive information or cause service disruption.
What an attacker can do
03Attacker Capabilities
Modify course or quiz content without proper authorization.
Potential impact on your site
04Site Impact
Unauthorized users can alter course materials, quizzes, or certificates, compromising course integrity.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege user account on the site.
Key dates
06Disclosure timeline
June 27, 2026
CVE published
June 29, 2026
Record updated
