Vulnerabilities / Masteriyo LMS – LMS Course Builder, Quizzes & Certificates / WPSEC-2026-1777
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates <= 3.4.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Course Progress Meta Modification via 'course_progress_item_id' Parameter
Medium 4.3
CWE-639Fixed in 3.5.0
- ID
- WPSEC-2026-1777
- Plugin
- Masteriyo LMS – LMS Course Builder, Quizzes & Certificates (learning-management-system)
- Affected
- from 2.16.0 before 3.5.0
- Remediation
- Update to 3.5.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-27
- Attack surface
- Masteriyo LMS – LMS Course Builder, Quizzes & Certificates on WPSec AttackSurface
- Fix released
- Published
Description
The Masteriyo LMS plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'course_progress_item_id' parameter of the course progress items REST endpoint in all versions up to, and including, 3.4.3, due to missing validation that the referenced progress row belongs to the current user and to the requested item. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the previously visited page meta on course progress rows belonging to other users.
References
- https://wpsec.com/vuln/WPSEC-2026-1777/
- https://plugins.svn.wordpress.org/learning-management-system/tags/3.5.0/
- https://wordpress.org/plugins/learning-management-system/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS