CVE-2026-65463 MEDIUM

CVE-2026-65463: WordPress Masteriyo - LMS plugin <= 2.3.1 - Insecure Direct Object References (IDOR) vulnerability

Vendor Masteriyo
Product Masteriyo - LMS
Weakness CWE-639 · IDOR
Published July 23, 2026
Last update July 23, 2026
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

What the vulnerability does

01Description

Subscriber Insecure Direct Object References (IDOR) in Masteriyo - LMS <= 2.3.1 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Masteriyo LMS versions up to 2.3.1 contain an authorization flaw that allows authenticated users to modify or disable site features. An attacker with a low-privilege account can alter data integrity or degrade service availability without elevated permissions. The vulnerability requires network access and valid login credentials but no user interaction beyond the initial authentication.

What an attacker can do

03Attacker Capabilities

Modify site data or degrade availability as a low-privilege authenticated user.

Potential impact on your site

04Site Impact

Authenticated users can alter course data or disrupt service availability without admin approval.

Conditions required to exploit

05Prerequisites

Valid login credentials with low-level account privileges; network access to the site.

Key dates

06Disclosure timeline

July 23, 2026 CVE published

Related vulnerabilities

08Related CVE

CVE-2026-9241 FOX – Currency Switcher Professional for WooCommerce <= 1.4.6 - Authenticated (Subscriber+) Authorization Bypass via User-Controlled Key to 'wooc_order_user_roles' Parameter CVE-2026-11987 Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Information Disclosure via 'id' Parameter CVE-2026-1291 Meow Gallery <= 5.4.4 - Missing Authorization to Authenticated (Author+) Shortcode creation CVE-2026-6965 Tutor LMS <= 3.9.9 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Post Deletion via 'course' GET Parameter CVE-2026-2729 Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.52.0 - Missing Authorization to Unauthenticated Stripe PaymentIntent Reuse / Underpayment Bypass via 'paymentid' Parameter