CVE-2026-10824: Masteriyo LMS Course Progress Unauthorized Access & Deletion Vulnerability

Technical summary

The course-progress REST API controller in Masteriyo LMS lacks authorization checks (missing capability or role validation). The vulnerability allows unauthenticated users to invoke API endpoints that read and permanently delete course-progress records via direct HTTP requests, bypassing WordPress authentication and capability systems. The affected REST routes do not validate user identity or permission before processing data-modifying or data-exposing operations.

Business impact

Organizations running Masteriyo LMS risk loss of student progress tracking, potential loss of learning records that may be critical for compliance or certification purposes, and reputational damage from unauthorized access to user data. If course completions drive credential issuance or billing, attackers could artificially inflate or delete progress to disrupt business logic or create fraudulent claims. Data deletion is irreversible without backups.

Affected systems

WordPress installations running the Masteriyo LMS plugin in versions before 2.2.1 are affected. The vulnerability requires network access to the WordPress site and targets the REST API endpoints used for course progress management. Any installation accessible via the public internet is at risk.

Exploitability

Exploitation is straightforward: an attacker needs only to craft HTTP requests to the course-progress REST API endpoints (typically /wp-json/masteriyo/*) without authentication. No user interaction, special network position, or complex exploitation is required—a simple HTTP client or curl script suffices to trigger the vulnerability. The barrier to entry is low.

Remediation

Update the Masteriyo LMS plugin to version 2.2.1 or later. Verify the updated version against the plugin repository or vendor advisory before deployment. After patching, consider auditing course-progress records and backups to detect any unauthorized deletions that may have occurred.

Patch guidance

Visit your WordPress admin dashboard, navigate to Plugins, and update Masteriyo LMS to 2.2.1 or higher. Confirm the update is successful and test course progress functionality before resuming normal operations. If you manage multiple WordPress sites, prioritize those with public-facing courses or those tied to formal credentialing.

Detection guidance

Monitor REST API logs for requests to /wp-json/masteriyo/*/course-progress* or similar endpoints originating from unauthenticated sessions (users not logged in). Look for unusual DELETE or POST requests to these endpoints from unfamiliar IP addresses. Enable REST API logging if not already active. Review course-progress deletion logs in Masteriyo audit trails for evidence of unauthorized changes.

Why prioritize this

Although the CVSS score is MEDIUM (6.5), the practical impact is high because course progress data is permanent once deleted, and the vulnerability is trivial to exploit. Organizations offering accredited courses, certifications, or compliance-linked training should prioritize patching to prevent loss of student records and potential regulatory issues.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects low attack complexity, no authentication requirement, and network-based access (AV:N, AC:L, PR:N). Confidentiality and integrity are both impacted (C:L, I:L), but availability is not directly affected by the vulnerability itself. The score does not capture the irreversible nature of data deletion; context-aware risk assessment should weigh the importance of course records in your organization.

Frequently asked questions