CVE-2026-8279

Masteriyo LMS <= 2.2.0 - Missing Authorization to Unauthenticated Arbitrary Course Progress Deletion

Published Sep 7, 2026 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Description

The Masteriyo LMS plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the 'delete_item_permissions_check' function in the CourseProgressItemsController in all versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to delete arbitrary course progress records belonging to any student.

Analysis

Technical impact

The Masteriyo LMS plugin for WordPress contains a missing capability check in the delete_item_permissions_check function of the CourseProgressItemsController. This flaw allows unauthenticated attackers to remove any course progress record belonging to any student, resulting in loss of learning progress data and the potential to tamper with assessment outcomes. The weakness is a missing authorization control (CWE‑862).

Affected Systems

All installations of Masteriyo LMS – LMS Course Builder, Quizzes & Certificates with versions 2.2.0 or earlier, including the 2.1.9 release referenced in the advisory.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. The attack requires no authentication or privileged access, meaning an attacker with internet access to the site can exploit the flaw trivially. The EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, so while the potential for widespread exploitation is not precisely measured, the lack of defensive checks makes the vulnerability actionable on any vulnerable instance.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

masteriyo

Masteriyo LMS – LMS Course Builder, Quizzes & Certificates

unaffected

Version	Status	Constraints
`0`	affected	≤ 2.2.0

No data.

Vendor Product Versions

Masteriyo

Masteriyo Lms – Lms Course Builder, Quizzes & Certificates

Version	Status	Scheme	Platform
`[0,2.2.0]`	affected	semver	—

Wordpress

Version	Status	Scheme	Platform
`—`	unaffected	—	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to Masteriyo LMS version 2.2.1 or later where the authorization check has been added.
If an upgrade is not immediately possible, add an authorization guard in the CourseProgressItemsController to require that the user is logged in or has the necessary capability before allowing deletion of course progress items.
Restrict REST API access by configuring WordPress to require authentication for the /wp-json/masteriyo/v1/course-progress-items endpoint, such as using the rest_authentication_errors filter or an .htaccess rule.

Generated by OpenCVE AI on September 7, 2026 at 14:15 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.403% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://plugins.trac.wordpress.org/browser/learning-management-system/tags/2.1.9/includes/Repository/CourseProgressItemRepository.php#L269
https://plugins.trac.wordpress.org/browser/learning-management-system/tags/2.1.9/includes/RestApi/Controllers/Version1/CourseProgressItemsController.php#L124
https://plugins.trac.wordpress.org/browser/learning-management-system/tags/2.1.9/includes/RestApi/Controllers/Version1/CourseProgressItemsController.php#L805
https://www.wordfence.com/threat-intel/vulnerabilities/id/d317d40b-2b99-408b-b445-1a789df3c958?source=cve

History

Sep 8, 2026 3:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 7, 2026 4:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Masteriyo Masteriyo masteriyo Lms – Lms Course Builder, Quizzes & Certificates Wordpress Wordpress wordpress
Vendors & Products		Masteriyo Masteriyo masteriyo Lms – Lms Course Builder, Quizzes & Certificates Wordpress Wordpress wordpress

Sep 7, 2026 12:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Masteriyo LMS plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the 'delete_item_permissions_check' function in the CourseProgressItemsController in all versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to delete arbitrary course progress records belonging to any student.
Title		Masteriyo LMS <= 2.2.0 - Missing Authorization to Unauthenticated Arbitrary Course Progress Deletion
Weaknesses		CWE-862
References		https://plugins.trac.wordpress.org/browser/learning-management-system/tags/2.1.9/includes/Repository/CourseProgressItemRepository.php#L269 https://plugins.trac.wordpress.org/browser/learning-management-system/tags/2.1.9/includes/RestApi/Controllers/Version1/CourseProgressItemsController.php#L124 https://plugins.trac.wordpress.org/browser/learning-management-system/tags/2.1.9/includes/RestApi/Controllers/Version1/CourseProgressItemsController.php#L805 https://www.wordfence.com/threat-intel/vulnerabilities/id/d317d40b-2b99-408b-b445-1a789df3c958?source=cve
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}`