Masteriyo LMS – LMS Course Builder, Quizzes & Certificates
learning-management-system · plugin
Known security vulnerabilities for Masteriyo LMS – LMS Course Builder, Quizzes & Certificates. Find out in seconds which version runs on your site with WP Lens.
21 known vulnerabilities
2 critical · 10 exploitable without logging in · 3 with public exploit code · latest Sep 11, 2026
Listed on wordpress.org · latest 3.4.3 · last updated Sep 30, 2026 · 6K+ installs
wordpress.org status checked on Oct 2, 2026
Vulnerabilities
- Critical 9.8
CVE-2026-73996unauthenticated≤ 2.3.2
WordPress Masteriyo - LMS plugin <= 2.3.2 - Arbitrary File Upload vulnerability
- Critical 9.8
CVE-2024-24882unauthenticated≤ 1.7.2
WordPress LMS by Masteriyo plugin <= 1.7.2 - Privilege Escalation vulnerability
- High 8.8
CVE-2026-62107unauthenticated≤ 3.4.0
WordPress Masteriyo - LMS plugin <= 3.4.0 - PHP Object Injection vulnerability
- High 8.8
CVE-2026-49111login required≤ 2.2.0
WordPress Masteriyo - LMS plugin <= 2.2.0 - Privilege Escalation vulnerability
- High 8.8
CVE-2026-4484login required≤ 2.1.6
Masteriyo LMS <= 2.1.6 - Missing Authorization to Authenticated (Student+) Privilege Escalation to Administrator
- High 8.1
CVE-2024-43239login required≤ 1.11.4
WordPress Masteriyo LMS plugin <= 1.11.4 - Insecure Direct Object Reference (IDOR) vulnerability
- High 7.5
CVE-2026-39524unauthenticated≤ 2.1.5
WordPress Masteriyo - LMS plugin <= 2.1.5 - Payment Bypass vulnerability
- High 7.5
CVE-2024-43158unauthenticated≤ 1.11.4
WordPress Masteriyo LMS plugin <= 1.11.4 - Broken Access Control vulnerability
- Medium 6.5
CVE-2026-42743unauthenticated≤ 2.1.8
WordPress Masteriyo - LMS plugin <= 2.1.8 - Broken Authentication vulnerability
- Medium 6.5
CVE-2026-59513subscriber+≤ 2.3.0
WordPress Masteriyo - LMS plugin <= 2.3.0 - Cross Site Scripting (XSS) vulnerability
- Medium 6.5
CVE-2025-64270login required≤ 2.0.3
WordPress Masteriyo - LMS plugin <= 2.0.3 - Sensitive Data Exposure vulnerability
- Medium 6.5
CVE-2025-54699login required≤ 1.18.3
WordPress Masteriyo - LMS Plugin plugin <= 1.18.3 - Cross Site Scripting (XSS) Vulnerability
- Medium 6.5
CVE-2024-10008login required≤ 1.13.3
Masteriyo LMS – eLearning and Online Course Builder for WordPress <= 1.13.3 - Authenticated (Student+) Missing Authorization to Privilege Escalation
- Medium 5.4
CVE-2026-65463subscriber+≤ 2.3.1
WordPress Masteriyo - LMS plugin <= 2.3.1 - Insecure Direct Object References (IDOR) vulnerability
- Medium 5.4
CVE-2024-10000login required≤ 1.13.3
Masteriyo LMS – eLearning and Online Course Builder for WordPress <= 1.13.3 - Authenticated (Student+) Stored Cross-Site Scripting via Ask a Question Functional
- Medium 5.3
CVE-2026-8279unauthenticated≤ 2.2.0
Masteriyo LMS <= 2.2.0 - Missing Authorization to Unauthenticated Arbitrary Course Progress Deletion
- Medium 5.3
CVE-2026-5167unauthenticated≤ 2.1.7
Masteriyo LMS <= 2.1.7 - Unauthenticated Authorization Bypass to Arbitrary Order Completion via Stripe Webhook Endpoint
- Medium 5.3
CVE-2024-33939unauthenticated≤ 1.7.3
WordPress LMS by Masteriyo plugin <= 1.7.3 - Broken Authentication vulnerability
- Medium 5.3
CVE-2024-43159unauthenticated≤ 1.11.6
WordPress Masteriyo LMS plugin <= 1.11.6 - Broken Access Control vulnerability
- Medium 5.3
CVE-2026-62132subscriber+≤ 3.4.0
WordPress Masteriyo - LMS plugin <= 3.4.0 - Broken Access Control vulnerability
- Medium 4.3
CVE-2026-11773login required≤ 2.2.1
Masteriyo LMS <= 2.2.1 - Missing Authorization to Authenticated (Student+) Arbitrary Course Announcement Modification
The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).