CVEvulnerability
CVE-2026-8279
5.3 MEDIUM
Official page ↗
- Status
- Deferred
- Published
- 2026-09-07
- Last modified
- 2026-09-08
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weaknesses
- CWE-862
Description
The Masteriyo LMS plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the 'delete_item_permissions_check' function in the CourseProgressItemsController in all versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to delete arbitrary course progress records belonging to any student.
Related
Weakness · CWE (1)
- CWE-862 Missing Authorization weakness
References
- https://plugins.trac.wordpress.org/browser/learning-management-system/tags/2.1.9/includes/Repository/CourseProgressItemRepository.php#L269 plugins.trac.wordpress.org
- https://plugins.trac.wordpress.org/browser/learning-management-system/tags/2.1.9/includes/RestApi/Controllers/Version1/CourseProgressItemsController.php#L124 plugins.trac.wordpress.org
- https://plugins.trac.wordpress.org/browser/learning-management-system/tags/2.1.9/includes/RestApi/Controllers/Version1/CourseProgressItemsController.php#L805 plugins.trac.wordpress.org
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d317d40b-2b99-408b-b445-1a789df3c958?source=cve www.wordfence.com