Privilege Escalation in Masteriyo LMS Plugin for WordPress
CVE-2026-4484
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 26 March 2026
What is CVE-2026-4484?
The Masteriyo LMS plugin for WordPress is susceptible to privilege escalation vulnerabilities that allow authenticated users, with Student-level access or higher, to modify their user role. This exploit arises from the 'InstructorsController::prepare_object_for_database' function, which inadequately verifies user permissions, enabling attackers to escalate their privileges to that of an administrator. This situation poses significant security risks to WordPress sites using the affected plugin versions.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
Masteriyo LMS – Online Course Builder for eLearning, LMS & Education * <= 2.1.6