WordPress Plugin Vulnerabilities

Masteriyo LMS < 2.2.1 - Missing Authorization to Unauthenticated Arbitrary Course Progress Deletion

Description

The Masteriyo LMS plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the 'delete_item_permissions_check' function in the CourseProgressItemsController in all versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to delete arbitrary course progress records belonging to any student.

Affects Plugins

Plugin icon
learning-management-system
Fixed in 2.2.1

References

CVE
CVE-2026-8279
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/d317d40b-2b99-408b-b445-1a789df3c958

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Jamshed Yergashvoyev (CVE Guy)
Verified
No
WPVDB ID
e2bd64d3-6ec2-488c-9f44-40b23546b326

Timeline

Publicly Published
2026-09-06 (about 8 days ago)
Added
2026-09-07 (about 7 days ago)
Last Updated
2026-09-07 (about 6 days ago)

Other

Published
Title
Published
2025-07-14
Title
Alone – Charity Multipurpose Non-profit WordPress Theme < 7.8.5 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation
Published
2023-10-20
Title
Post Meta Data Manager < 1.2.1 - Missing Authorization to Post, Term, and User Meta Deletion
Published
2026-02-15
Title
FooGallery < 3.1.13 - Missing Authorization
Published
2024-12-02
Title
Simple User Registration < 6.0 - Missing Authorization to User Deletion
Published
2021-12-30
Title
Link Library < 7.2.8 - Unauthenticated Arbitrary Links Deletion