Executive brief
The Masteriyo LMS plugin for WordPress, which is used to create and manage online courses, contains a security flaw in its progress tracking system. This vulnerability allows anyone on the internet to view or permanently delete the course progress records of any student without needing to log in. This could lead to the loss of student data and disruption of the learning experience for users of the platform.
Technical details
The Masteriyo LMS plugin for WordPress is vulnerable to an authentication bypass and broken access control within its REST API. Specifically, the course-progress controller fails to implement proper authorization checks for GET and DELETE requests. An unauthenticated remote attacker can exploit this by sending crafted requests to the `/wp-json/masteriyo/v1/course-progress/items/{id}` endpoint. This allows for the unauthorized disclosure of student activity data (Vector 1) and the permanent deletion of course progress records from the database (Vector 2). The issue is resolved in version 2.2.1, which introduces proper permission checks.
Affected products
- Masteriyo Masteriyo LMS < 2.2.1
Timeline
- 2026-06-04: disclosed: Initial public disclosure by researcher
- 2026-06-25: advisory: NVD publication date
- 2026-06-25: patched: Vulnerability fixed in version 2.2.1