# CVE-2026-62132: Masteriyo LMS broken access control in subscriber pages

Source: https://junglewise.ai/threats/cve-2026-62132-masteriyo-lms-broken-access-control-in-subscriber-pages  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-11. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-62132 · Severity: medium · CVSS 5.3 · Published 2026-09-11

Masteriyo is a learning management system plugin for WordPress that allows organizations to create and manage online courses. The plugin contains an access control flaw that allows subscribers to view or access pages and content they should not have permission to see, potentially exposing sensitive course materials or other users' data.

Technologies: [ThemeGrill Masteriyo - LMS](https://junglewise.ai/threats/technologies/masteriyo-lms). Vendors: [ThemeGrill](https://junglewise.ai/threats/vendors/themegrill).

## Quick answers

**Is CVE-2026-62132 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62132 being exploited in the wild.

**How severe is CVE-2026-62132?** Medium severity, with a CVSS score of 5.3, published 11 September 2026.

**Which products and versions are affected?** ThemeGrill Masteriyo - LMS 3.4.0 and earlier.

**Is there a fix for CVE-2026-62132?** A patch was published on 2026-09-10: Version 3.4.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-62132 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-62132?** Check whether you run ThemeGrill Masteriyo - LMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a broken access control issue in Masteriyo LMS versions 3.4.0 and earlier. Subscribers with basic permissions can bypass authorization checks to access restricted pages or perform actions reserved for higher-privilege roles. The attack requires only subscriber-level authentication (no elevated privileges needed) and is exploitable over the network. An attacker with a subscriber account can view unauthorized course content or access other users' data. The vulnerability was patched in version 3.4.1.

## Affected products

- ThemeGrill Masteriyo - LMS 3.4.0 and earlier

## Timeline

- 2026-09-10: disclosed: Published by Patchstack
- 2026-09-10: patched: Version 3.4.1 released

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/learning-management-system/vulnerability/wordpress-masteriyo-lms-plugin-3-4-0-broken-access-control-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/learning-management-system/vulnerability/wordpress-masteriyo-lms-plugin-3-4-0-broken-access-control-vulnerability?_s_id=cve)

## Related threats

- [Masteriyo LMS arbitrary content deletion](https://junglewise.ai/threats/cve-2026-116410-unauthenticated-arbitrary-content-deletion-in-masteriyo-lms-3-4)
- [Masteriyo LMS PHP object injection vulnerability](https://junglewise.ai/threats/cve-2026-62107-masteriyo-lms-php-object-injection-vulnerability)
- [ThemeGrill Masteriyo LMS IDOR in versions up to 2.3.1](https://junglewise.ai/threats/cve-2026-65463-themegrill-masteriyo-lms-idor-in-versions-up-to-2-3-1)
- [ThemeGrill Masteriyo LMS broken authentication](https://junglewise.ai/threats/cve-2026-42743-themegrill-masteriyo-lms-broken-authentication)
- [ThemeGrill Masteriyo LMS broken access control payment bypass](https://junglewise.ai/threats/cve-2026-39524-themegrill-masteriyo-lms-broken-access-control-payment-bypass)