CVE-2026-82848

Deferred Deferred - Pending Action

Unauthenticated Course Enrolment Data Exposure in Masteriyo LMS

Publication date: 2026-09-09

Last updated on: 2026-09-09

Assigner: WPScan

Description

The Masteriyo LMS WordPress plugin before 3.4.0 does not perform any authorization check before returning a course enrolment record over its REST API, allowing unauthenticated users to read any learner's enrolment status, timestamps and course-progress data by walking sequential record identifiers. A related gap lets any enrolled user retrieve other learners' enrolment records as well.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-09

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-82848

EUVD

EUVD-2026-74712

Affected Vendors & Products

Vendor	Product	Version / Range
masteriyo	masteriyo_lms	to 3.4.0 (exc)
masteriyo	masteriyo_lms	1.3.1
masteriyo	masteriyo_lms	2.3.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

The Masteriyo LMS WordPress plugin before version 3.4.0 has a vulnerability where it does not check authorization before returning course enrollment records via its REST API. This allows unauthenticated users to access and read any learner's enrollment status, timestamps, and course progress data by using sequential record identifiers. Additionally, enrolled users can retrieve other learners' enrollment records without proper authorization.

Detection Guidance

Check if the Masteriyo LMS plugin version is between 1.3.1 and 2.3.3. Use WordPress admin panel or run a command like 'wp plugin list' to verify the installed version. Test the REST API endpoints for unauthorized access to enrollment records by attempting to retrieve sequential IDs.

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive learner data, including enrollment status, timestamps, and course progress. Attackers could exploit this to gather personal information or track user activity without consent, potentially violating privacy.

Compliance Impact

This vulnerability could result in non-compliance with GDPR and HIPAA due to unauthorized access to personal and sensitive data. GDPR requires protecting personal data, while HIPAA mandates safeguarding health-related information. The exposure of such data may lead to legal penalties and reputational damage.

Mitigation Strategies

Update the Masteriyo LMS plugin to version 3.4.0 or later immediately. If updating is not possible, disable the plugin temporarily until the update is applied. Review and restrict access to REST API endpoints to prevent unauthorized data exposure.

Hi! I’m here to help you understand CVE-2026-82848. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70