Is CVE-2026-13332 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-13332 being exploited in the wild.

How severe is CVE-2026-13332?

Informational severity, with a CVSS score of 3.7, published 27 July 2026.

Which products and versions are affected?

Masteriyo Masteriyo LMS < 2.3.1.

Is there a fix for CVE-2026-13332?

A patch was published on 2026-07-27: Fixed in version 2.3.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-13332 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-13332?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13332: Masteriyo LMS unauthenticated session termination in AJAX action

Q: Is there a fix for CVE-2026-13332?

A patch was published on 2026-07-27: Fixed in version 2.3.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-13332 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-13332?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13332 · Severity: info · CVSS 3.7 · Published 2026-07-27

Masteriyo LMS, a learning management system plugin for WordPress, contains a security flaw that allows unauthorized individuals to force other users to log out. By exploiting an unprotected session management feature, an attacker can repeatedly terminate the active sessions of any user, including site administrators. This results in a denial of service for legitimate users, disrupting their ability to access the platform or perform administrative tasks.

Quick answers

Is CVE-2026-13332 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-13332 being exploited in the wild.
How severe is CVE-2026-13332?: Informational severity, with a CVSS score of 3.7, published 27 July 2026.
Which products and versions are affected?: Masteriyo Masteriyo LMS < 2.3.1.
Is there a fix for CVE-2026-13332?: A patch was published on 2026-07-27: Fixed in version 2.3.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-13332 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-13332?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Masteriyo LMS plugin fails to implement proper authorization checks on the 'masteriyo_clear_sessions' AJAX action. An unauthenticated attacker can obtain a valid session-clearing nonce by triggering a session limit warning via the 'masteriyo_login' action using a known username. Once the nonce is obtained, the attacker can send a POST request to 'admin-ajax.php' targeting a specific 'user_id' to destroy all active session tokens for that user. This vulnerability effectively allows for unauthenticated arbitrary user session termination, leading to a targeted denial of service. The issue is fixed in version 2.3.1.

Affected products

Masteriyo Masteriyo LMS < 2.3.1

Timeline

2026-07-06: disclosed: Publicly published by WPScan
2026-07-27: advisory: CVE published to NVD dataset
2026-07-27: patched: Fixed in version 2.3.1

References

https://wpscan.com/vulnerability/f987c823-f215-48f6-86fe-8d898f2c2d94/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.