The Masteriyo LMS plugin for WordPress suffers from an authorization bypass that allows authenticated users with at least student-level privileges to modify the content of any course announcement, regardless of the original author. This flaw arises because the plugin fails to verify that the current user has proper rights before performing the edit operation. As a result, an attacker who can log in as a student can alter announcements created by instructors or administrators, potentially undermining the integrity of course communication.

Masteriyo LMS – LMS Course Builder, Quizzes & Certificates, versions up to and including 2.2.1 on WordPress sites are affected. All users with student or higher roles can exploit this weakness.

The CVSS score of 4.3 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user in the system, typically a student logged into the WordPress admin area. The flaw gives the attacker the ability to alter announcement content, which could be used to spread misinformation or disrupt learning, but it does not provide remote code execution or privilege escalation beyond the user role. Overall risk is moderate with limited immediate impact beyond content integrity.