Improper Access Control Flaw in Masteriyo LMS Plugin for WordPress
CVE-2026-82849
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 24 September 2026
Badges
What is CVE-2026-82849?
The Masteriyo LMS plugin for WordPress prior to version 3.4.2 exhibits an improper access control vulnerability. This flaw permits authenticated users, including self-registered subscribers, to access and read other users' course-progress records. Specifically, the plugin fails to properly verify the ownership of the requested course data. An ownership check is bypassed if the requested account is not specified with a non-zero value, resulting in the exposure of records from all learners on the platform. This can lead to unauthorized visibility of sensitive learning activities, posing a significant risk for user privacy.
Affected Version(s)
Masteriyo LMS 0 < 3.4.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.