Masteriyo LMS – Online Course Builder for eLearning, LMS & Education: Privilege escalation or authentication bypass
Masteriyo LMS – Online Course Builder for eLearning, LMS & Education is affected by privilege escalation or authentication bypass. Exploitation requires an authenticated WordPress account. A successful request can grant permissions or access that the caller should not possess. The published affected range is <= 2.1.6.
- Component
- Masteriyo LMS – Online Course Builder for eLearning, LMS & Education
- Plugin slug
learning-management-system- Affected
- <= 2.1.6
- Safe version
> 2.1.6- Published
- Mar 26, 2026
- Weakness
- CWE-862 — Missing Authorization
This CVE was published Mar 26, 2026 and is one of 14 known issues for this plugin.
Patch or disable the affected component.
Update Masteriyo LMS – Online Course Builder for eLearning, LMS & Education to a release after 2.1.6, or disable and remove it until a fixed version is available.
Technical description
The Masteriyo LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.1.6. This is due to the plugin allowing a user to update the user role through the 'InstructorsController::prepare_object_for_database' function. This makes it possible for authenticated attackers, with Student-level access and above, to elevate their privileges to that of an administrator.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H