CVE-2026-82850
Received Received - Intake

Masteriyo LMS Quiz Answer Key Exposure Vulnerability

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: WPScan

Description
The Masteriyo LMS WordPress plugin before 3.4.2 does not restrict access to quiz answer keys, allowing any authenticated user, such as a student, to retrieve the correct answers for any quiz on the site, including quizzes in courses they are not enrolled in. The redaction that hides them is applied only to a fixed list of question types, so the answers to every other type are returned in full to anyone able to view the questions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-82850
EUVD
EUVD-2026-85799

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
masteriyo lms to 3.4.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Masteriyo LMS WordPress plugin before version 3.4.2 has a vulnerability where authenticated users, including students with basic roles, can access quiz answer keys without restrictions. The plugin fails to properly redact answers for most question types, exposing correct answers for all quizzes, even those in courses the user is not enrolled in.

Detection Guidance

Check if your Masteriyo LMS plugin version is below 3.4.2. Inspect network traffic for unauthorized access to quiz answer endpoints or sensitive data exposure in responses. Review server logs for unusual requests to quiz-related endpoints by non-admin users.

Impact Analysis

This vulnerability allows unauthorized users to view correct answers for quizzes they should not have access to. It compromises the integrity of assessments by exposing answers to students who may not be enrolled in the course or permitted to see them. This could lead to cheating or unfair advantages in academic settings.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA due to unauthorized access to sensitive quiz answer data. GDPR requires protection of personal data, and HIPAA mandates safeguarding protected health information. Unrestricted access to quiz answers may expose personal or sensitive information, leading to non-compliance with these regulations.

Mitigation Strategies

Update the Masteriyo LMS plugin to version 3.4.2 or later immediately. Restrict access to quiz endpoints by reviewing and updating user role permissions. Monitor for any suspicious activity related to quiz data access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82850. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart