# Masteriyo LMS – LMS Course Builder, Quizzes & Certificates <= 3.4.3 - Unauthenticated Authentication Bypass via Webhook Action Endpoint

- **ID:** WPSEC-2026-1775
- **Plugin:** Masteriyo LMS – LMS Course Builder, Quizzes & Certificates (`learning-management-system`), https://wordpress.org/plugins/learning-management-system/
- **Affected versions:** from 2.19.0 before 3.5.0
- **Fixed in:** 3.5.0 (Update to 3.5.0 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-287
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-27)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/learning-management-system
- **Fix released:** 2026-10-26
- **Published:** 2026-10-27
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1775/

## Description

The Masteriyo LMS plugin for WordPress is vulnerable to Authentication Bypass via the webhooks/action REST endpoint in versions 2.19.0 through 3.4.3, due to the masteriyo_webhook_action_permission_callback() function looking up an instructor by the supplied token without rejecting an empty token, so the user query drops its meta value condition and matches any instructor holding a webhook token. This makes it possible for unauthenticated attackers to run non-privileged webhook actions, such as creating student accounts, enrolling or unenrolling users, completing lessons or courses, and resetting course progress, on courses owned by an instructor who has generated a webhook token.

## References

- https://wpsec.com/vuln/WPSEC-2026-1775/
- https://plugins.svn.wordpress.org/learning-management-system/tags/3.5.0/
- https://wordpress.org/plugins/learning-management-system/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1775/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.