Authorization Bypass in Masteriyo LMS Course Builder Plugin for WordPress
CVE-2026-11773

4.3MEDIUM

Key Information:

Vendor

WordPress
Status
Masteriyo Lms – Lms Course Builder, Quizzes & Certificates
Vendor
CVE Published:
27 June 2026

What is CVE-2026-11773?

The Masteriyo LMS – LMS Course Builder, Quizzes & Certificates plugin for WordPress is susceptible to an authorization bypass flaw in all versions up to and including 2.2.1. This vulnerability arises because the plugin fails to adequately verify user permissions, allowing authenticated users with student-level access or higher to alter course announcement descriptions created by instructors or administrators. This weakness can potentially lead to the unauthorized modification of critical course content, undermining the integrity of educational materials.

Affected Version(s)

Masteriyo LMS – LMS Course Builder, Quizzes & Certificates 0 <= 2.2.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/learning-manag...
https://plugins.trac.wordpress.org/browser/learning-manag...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ilinor
.