Authorization Bypass Vulnerability in Masteriyo LMS Plugin for WordPress

CVE-2026-5167

What is CVE-2026-5167?

The Masteriyo LMS plugin, designed for online learning platforms on WordPress, contains a vulnerability that allows unauthorized users to bypass authorization controls. This issue is rooted in the insufficient verification of webhook signatures within its handle_webhook() function. Attackers can exploit this flaw by sending malicious, unauthenticated requests to the webhook endpoint, which processes payloads without proper verification. Because the default configuration for the webhook_secret is an empty string, unauthorized individuals can submit fake Stripe webhook events that manipulate order statuses, enabling them to mark any course as paid and access premium content without proper authorization.

References