CVE-2026-8279
Received Received - Intake

Unauthenticated Data Deletion in Masteriyo LMS WordPress Plugin

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: Wordfence

Description
The Masteriyo LMS plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the 'delete_item_permissions_check' function in the CourseProgressItemsController in all versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to delete arbitrary course progress records belonging to any student.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-8279
EUVD
EUVD-2026-72368

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
masteriyo masteriyo_lms to 2.2.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Masteriyo LMS plugin for WordPress has a vulnerability that allows unauthenticated attackers to delete course progress records of any student. This happens because the plugin fails to check user permissions before allowing deletions in the CourseProgressItemsController.

Impact Analysis

If you use the Masteriyo LMS plugin, attackers could delete student course progress data, leading to loss of important records. This could disrupt learning tracking and require manual recovery of lost data.

Compliance Impact

This vulnerability could violate data integrity requirements under GDPR and HIPAA, as unauthorized deletion of student records may constitute a breach of data protection obligations. Organizations using this plugin may face compliance risks.

Mitigation Strategies

Update the Masteriyo LMS plugin to the latest version beyond 2.2.0 to fix the missing capability check. If an update is not available, consider disabling the plugin temporarily until a patch is released.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-8279. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart