A flaw in the Masteriyo LMS WordPress plugin disables authorization checks on a course-progress REST API controller. Unauthenticated users can read the course-progress information of any user and can permanently delete that data, exposing confidential learning records and destroying integrity of the system. This vulnerability is a classic improper access control issue (CWE-284).

All installations of the Masteriyo LMS plugin for WordPress with a version older than 2.2.1 are affected; no specific vendor or additional product versions are listed.

The vulnerability can be triggered simply by sending HTTP requests to the exposed REST endpoint, without any authentication. Because it allows data read and deletion, an attacker could harvest private progress metrics or sabotage users’ learning paths. No EPSS score is available and the issue is not included in CISA’s KEV catalog, but the lack of authentication suggests the attack surface is broadly accessible. The risk is significant for sites that rely on Masteriyo LMS to track student progress.