{
 "id": "WPSEC-2026-1777",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1777/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1777/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1777/index.md",
 "title": "Masteriyo LMS – LMS Course Builder, Quizzes & Certificates <= 3.4.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Course Progress Meta Modification via 'course_progress_item_id' Parameter",
 "description": "The Masteriyo LMS plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'course_progress_item_id' parameter of the course progress items REST endpoint in all versions up to, and including, 3.4.3, due to missing validation that the referenced progress row belongs to the current user and to the requested item. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the previously visited page meta on course progress rows belonging to other users.",
 "plugin": {
  "slug": "learning-management-system",
  "name": "Masteriyo LMS – LMS Course Builder, Quizzes & Certificates",
  "full_name": "Masteriyo LMS – LMS Course Builder, Quizzes & Certificates",
  "wordpress_org": "https://wordpress.org/plugins/learning-management-system/",
  "advisories_url": "https://wpsec.com/vuln/plugin/learning-management-system/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/learning-management-system"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.16.0",
    "from_inclusive": true,
    "to": "3.5.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.16.0 before 3.5.0"
  ]
 },
 "introduced_in": "2.16.0",
 "fixed_in": "3.5.0",
 "remediation": "Update to 3.5.0 or later.",
 "fix_released": "2026-10-26T17:51:45+00:00",
 "published": "2026-10-27T18:42:07+00:00",
 "updated": "2026-10-27T13:39:56.396435+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1777/",
  "https://plugins.svn.wordpress.org/learning-management-system/tags/3.5.0/",
  "https://wordpress.org/plugins/learning-management-system/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/learning-management-system",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-27"
 }
}