Unauthorized Access to Quiz Answers in Masteriyo LMS by WordPress
CVE-2026-82850
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 24 September 2026
Badges
What is CVE-2026-82850?
The Masteriyo LMS plugin for WordPress presents a significant access control weakness, allowing authenticated users, including students, to retrieve the correct answers to quizzes. This vulnerability occurs due to improper access restrictions, enabling users to access answer keys for quizzes across courses they are not enrolled in. Although there is a mechanism in place that attempts to redact answers for specific question types, this fix is not comprehensive, leaving answers for other question types exposed. As a result, any authenticated user may exploit this flaw to gain an unfair advantage in assessments, undermining the integrity of the educational platform.
Affected Version(s)
Masteriyo LMS 0 < 3.4.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.