# CVE-2025-53209: Themeisle Masteriyo LMS PRO privilege escalation

Source: https://junglewise.ai/threats/cve-2025-53209-themeisle-masteriyo-lms-pro-privilege-escalation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-02. Updated: 2026-06-02  
License: CC BY 4.0 with a link back

CVE-2025-53209 · Severity: critical · CVSS 9.8 · Published 2026-06-02

Themeisle Masteriyo LMS PRO, a WordPress plugin used for creating and managing online courses, contains a critical security flaw that allows unauthorized users to gain administrative control. An attacker can exploit this to take over the website, potentially accessing sensitive student data, modifying course content, or disrupting business operations. This vulnerability is highly dangerous as it requires no prior account or special access to execute.

Vendors: [Themeisle](https://junglewise.ai/threats/vendors/themeisle).

## Quick answers

**Is CVE-2025-53209 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-53209 being exploited in the wild.

**How severe is CVE-2025-53209?** Critical severity, with a CVSS score of 9.8, published 2 June 2026.

**Which products and versions are affected?** Themeisle Masteriyo LMS PRO <= 2.20.0.

**Is there a fix for CVE-2025-53209?** A patch was published on 2025-07-01: Version 2.20.1 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-53209 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-53209?** Check whether you run Themeisle Masteriyo LMS PRO at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An Incorrect Privilege Assignment vulnerability (CWE-266) exists in the Themeisle Masteriyo LMS PRO plugin for WordPress through version 2.20.0. The flaw allows an unauthenticated remote attacker to escalate their privileges, potentially gaining administrator-level access to the affected site. The vulnerability is exploitable over the network with low complexity and requires no user interaction. A patch is available in version 2.20.1, which addresses the improper assignment of user roles or permissions.

## Affected products

- Themeisle Masteriyo LMS PRO <= 2.20.0

## Timeline

- 2025-06-11: other: Reported by researcher 0xd4rk5id3
- 2025-07-01: disclosed: Initial disclosure by Patchstack
- 2025-07-01: patched: Version 2.20.1 released to address the vulnerability
- 2026-06-02: advisory: NVD publication date

## References

- [https://patchstack.com/database/wordpress/plugin/learning-management-system-pro/vulnerability/wordpress-masteriyo-lms-pro-2-20-0-privilege-escalation-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/learning-management-system-pro/vulnerability/wordpress-masteriyo-lms-pro-2-20-0-privilege-escalation-vulnerability?_s_id=cve)