WordPress Plugin Vulnerabilities

Masteriyo LMS – LMS Course Builder, Quizzes & Certificates < 2.3.2 - Authenticated (Subscriber+) Insecure Direct Object Reference

Description

The Masteriyo LMS – LMS Course Builder, Quizzes & Certificates plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.3.1 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
learning-management-system
Fixed in 2.3.2

References

CVE
CVE-2026-65463
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/67ff1f6e-0bea-4e09-ac3d-727d13fcbfa1

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Celvex Group
Verified
No
WPVDB ID
b65548af-925f-4336-9899-ae869cc27889

Timeline

Publicly Published
2026-07-22 (about 1 month ago)
Added
2026-07-29 (about 27 days ago)
Last Updated
2026-07-29 (about 27 days ago)

Other

Published
Title
Published
2026-03-20
Title
REST API TO MiniProgram <= 5.1.2 - Subscriber+ Insecure Direct Object Reference via 'userid'
Published
2024-05-15
Title
BuddyBoss Platform < 2.6.0 - Subscriber+ Comment on Private Post via IDOR
Published
2026-05-01
Title
App Builder <= 5.5.10 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Avatar Modification via 'user_id' Parameter
Published
2024-08-12
Title
WP Job Portal < 2.1.9 - Subscriber+ Insecure Direct Object Reference
Published
2023-07-05
Title
BadgeOS <= 3.7.1.6 - Subscriber+ IDOR