The vulnerability arises from missing authorization checks in the plugin’s API controller, allowing any authenticated user with Student or higher permissions to change user roles. An attacker who is logged in can promote themselves or other users to the Administrator role, giving full control over the site and access to all data and configuration. This type of flaw is a classic missing authorization weakness (CWE‑862) and can lead to complete compromise of the WordPress installation.

The Masteriyo LMS plugin for WordPress is affected in all releases up to and including version 2.1.6. The vulnerability applies to the plugin’s REST API endpoints responsible for instructor and role management. Site owners using Masteriyo LMS before the official fix should review which users have elevated privileges and audit role assignments.

The CVSS rating of 8.8 indicates a high severity, and the EPSS score of less than 1 % suggests that the probability of current exploitation is low, though the risk remains significant if a breach is achieved. The flaw is listed as a privilege escalation that requires authenticated access; an attacker would need valid credentials with at least Student rights to exploit it. Because the issue is not in the CISA KEV catalog, there are no confirmed public exploits known at this time.