Description

The Masteriyo LMS plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the 'delete_item_permissions_check' function in the CourseProgressItemsController in all versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to delete arbitrary course progress records belonging to any student.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-07T13:20:43.560Z",
  "pubdate": "2026-09-07T13:20:43.560Z",
  "executiveSummary": "The Masteriyo LMS plugin for WordPress contains a critical security vulnerability involving improper authorization, specifically a missing capability check within the CourseProgressItemsController.\nThis flaw allows unauthenticated remote attackers to trigger the deletion of arbitrary course progress records for any student within the platform.\nThe vulnerability is classified as an authorization bypass, which effectively grants unauthorized users the ability to manipulate sensitive user-related learning data.\nThe affected component, delete_item_permissions_check, fails to validate the requestor's identity or permissions before executing the deletion logic.\nThe risk implication is high, as it enables malicious actors to disrupt educational progress tracking, sabotage student records, and potentially cause widespread data loss across the LMS environment.\nNo authentication is required to exploit this flaw, meaning any visitor to the site can execute the malicious action if the endpoint is accessible.\nThe vulnerability affects all versions of the Masteriyo LMS plugin up to and including 2.2.0.",
  "technicalDetails": "The root cause of this vulnerability is an inadequate implementation of access control within the 'CourseProgressItemsController' class, specifically the 'delete_item_permissions_check' function. In secure WordPress plugin development, any function that performs sensitive operations—such as data deletion—must verify the user's session and capabilities using functions like current_user_can().\nIn this instance, the controller lacks the necessary conditional checks to ensure that the user attempting to delete a course progress item has the appropriate administrative privileges or ownership rights to the data being targeted.\nThe attack flow begins when an attacker sends a crafted request, typically via an HTTP POST or DELETE method, directed at the vulnerable endpoint associated with the CourseProgressItemsController. Because the 'delete_item_permissions_check' function performs no validation, it returns a 'true' status or proceeds with execution regardless of the user's current authentication state.\nThe payload generally involves targeting specific IDs associated with course progress records. By iterating through these identifiers, an unauthenticated attacker can effectively enumerate and remove progress data from the database. The system processes these requests as legitimate administrative actions because the authorization check is entirely bypassed.\nThe vulnerable component is identified within the file handling progress items, specifically where the deletion routine is invoked. Since the plugin fails to enforce 'manage_options' or 'edit_posts' capability checks, the underlying database records are subjected to unrestricted deletion. The impact post-exploitation includes the irreversible removal of course completion data, user history, and progress tracking, leading to significant disruption in the LMS functionality and potential loss of intellectual property or student achievement records.\nThe exposure is global to the WordPress installation where Masteriyo LMS is active, requiring only network access to the target site. Because the vulnerability lies within the logic of the plugin itself, there is no reliance on user interaction or specific environmental configurations beyond having the affected versions installed. Any user-supplied ID passed to the vulnerable function is treated as a target for deletion, bypassing any logical boundary that should have restricted the scope to the requester's own data or prevented access entirely for unauthenticated entities."
}