Junglewise Threat Intelligence

CVE-2026-5167: Masteriyo LMS auth bypass in Stripe webhook handler

CVE-2026-5167 · Severity: medium · CVSS 5.3 · Published 2026-04-08

Executive brief

The Masteriyo LMS plugin for WordPress, which is used to create and manage online courses, contains a security flaw in its payment processing system. An attacker can bypass the payment requirement by sending fake notifications to the website, tricking the system into thinking a purchase was completed via Stripe. This allows unauthorized users to gain free access to paid educational content, potentially leading to lost revenue and unauthorized access to intellectual property.

Technical details

The Masteriyo LMS plugin for WordPress is vulnerable to an authorization bypass (CWE-639) in versions up to and including 2.1.7 due to insufficient signature verification in the handle_webhook() function. The webhook endpoint processes unauthenticated requests and only validates signatures if a 'webhook_secret' is configured and the 'HTTP_STRIPE_SIGNATURE' header is present. Because the secret defaults to an empty string, the plugin may process arbitrary JSON payloads without verification. An unauthenticated attacker can exploit this by sending forged Stripe webhook events with manipulated 'order_id' values in the metadata to mark orders as complete. A patch is available in versions following 2.1.7.

Affected products

  • Masteriyo Masteriyo LMS – Online Course Builder for eLearning, LMS & Education <= 2.1.7

Timeline

  • 2026-04-08: advisory: Original publication date
  • 2026-04-08: disclosed: Vulnerability disclosed by Wordfence

References