Quick answers
- Is CVE-2026-42743 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-42743 being exploited in the wild.
- How severe is CVE-2026-42743?
- Medium severity, with a CVSS score of 6.5, published 15 June 2026.
- Which products and versions are affected?
- ThemeGrill Masteriyo - LMS <= 2.1.8.
- Is there a fix for CVE-2026-42743?
- A patch was published on 2026-06-15: Patch available in version 2.1.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-42743 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-42743?
- Check whether you run ThemeGrill Masteriyo - LMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The Masteriyo - LMS plugin for WordPress (versions <= 2.1.8) contains a broken authentication vulnerability, specifically related to improper verification of cryptographic signatures (CWE-347). This flaw allows an unauthenticated remote attacker to bypass security checks and potentially perform actions with elevated privileges. The vulnerability is exploitable over the network without user interaction. Successful exploitation could lead to unauthorized access to administrative functions or account takeover. The issue is resolved in version 2.1.9.
Affected products
- ThemeGrill Masteriyo - LMS <= 2.1.8
Timeline
- 2026-04-28: other: Reported by researcher HieuPenguinnn
- 2026-05-28: advisory: Initial disclosure by Patchstack
- 2026-06-15: disclosed: CVE published to NVD
- 2026-06-15: patched: Patch available in version 2.1.9