CVE-2026-59513

The Masteriyo - LMS plugin version 2.3.1 and earlier contains an Insecure Direct Object References (IDOR) vulnerability exploitable by a subscriber. A subscriber can access other users' resources.

Unauthenticated Arbitrary File Upload vulnerability in Masteriyo - LMS plugin versions up to 2.3.2. An attacker without authentication can upload arbitrary files to the server.

The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessions, allowing unauthenticated attackers to terminate the active sessions (force-logout) of any user on the site, including administrators.

The Masteriyo LMS WordPress plugin before version 2.3.3 does not sanitize and escape a quiz field before output, and grants instructors the ability to store unfiltered HTML, allowing Stored XSS attacks against any visitor, including administrators. Default single-site installations are affected; multisite or DISALLOW_UNFILTERED_HTML sites are not.

The Masteriyo LMS plugin for WordPress up to version 2.2.1 contains an authorization bypass vulnerability. Authenticated attackers with student-level access or higher can modify the content of course announcements created by instructors or administrators.

Masteriyo - LMS versions up to 2.1.8 contain a vulnerability in authentication that allows unauthorized access.

Masteriyo - LMS versions up to 2.1.5 contain a vulnerability in access control that allows unauthorized access.

The Masteriyo LMS plugin for WordPress up to version 2.1.7 has an authorization bypass vulnerability due to insufficient webhook signature verification. Unauthenticated attackers can send fake Stripe webhook events and mark any order as completed without payment.