Description

Subscriber Broken Access Control in Masteriyo - LMS <= 3.4.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-11T19:17:44.493Z",
  "pubdate": "2026-09-11T19:17:44.493Z",
  "executiveSummary": "The Masteriyo LMS plugin for WordPress, in versions 3.4.0 and below, contains a critical broken access control vulnerability.\nThis vulnerability allows authenticated users with low-level privileges, such as Subscribers, to bypass standard authorization checks and perform unauthorized administrative or sensitive operations within the plugin.\nThe flaw stems from insufficient server-side validation of user capabilities before executing sensitive plugin functions.\nBy manipulating API requests or HTTP parameters, an attacker can access restricted data or perform unauthorized actions, potentially leading to unauthorized data modification, information disclosure, or configuration changes.\nThe impact is significant, as it effectively elevates the privileges of a standard user account to that of a high-privileged user or administrator regarding the plugin's functionality.\nNo complex exploitation conditions are required beyond having an active registered account on the WordPress instance where Masteriyo LMS is installed.\nThis vulnerability represents a significant security risk, as it circumvents the principle of least privilege, providing a direct vector for unauthorized system interaction.",
  "technicalDetails": "The vulnerability is identified as a broken access control issue affecting the Masteriyo LMS plugin for versions 3.4.0 and below. The core issue originates from the improper implementation of authorization checks within the plugin's backend request handlers.\nIn WordPress plugin development, developers must explicitly verify user capabilities (e.g., using current_user_can()) before allowing access to functions that perform sensitive operations, such as creating, updating, or deleting LMS data, or accessing sensitive settings. In this specific vulnerability, the plugin fails to consistently perform these checks for certain API endpoints or administrative actions.\nAn authenticated user with the 'Subscriber' role possesses a valid session on the target WordPress site. The exploit flow begins when this user sends specially crafted HTTP requests to the vulnerable endpoints exposed by the Masteriyo LMS plugin.\nBecause the server-side code fails to validate the user's role and associated capabilities against the requested operation, the plugin executes the requested action with the privileges of the application, effectively bypassing the access restrictions intended to be applied to non-administrative users.\nThe exploitation process does not require any specific advanced technical setup; the attacker simply needs to identify the targeted API endpoints and provide the expected parameters within an HTTP request. Upon receipt, the vulnerable component processes these requests without verifying the authorization context.\nThe post-exploitation impact includes the ability of an unauthorized user to modify course content, alter student progress data, potentially access user information related to the LMS, or disrupt the intended workflow of the plugin by changing critical plugin settings.\nThis vulnerability is categorized as a failure in access control, where the software does not enforce the principle of least privilege. The affected component is the internal API and backend request routing mechanism within Masteriyo LMS that handles privileged actions without adequate authorization verification. All sites running version 3.4.0 or lower are susceptible if users are allowed to register on the platform, providing the attacker with the necessary low-level authentication context to initiate the attack."
}