CVE-2026-10824: Masteriyo LMS Auth Bypass Vulnerability

CVE-2026-10824 Overview

CVE-2026-10824 affects the Masteriyo LMS WordPress plugin in versions prior to 2.2.1. The plugin exposes a course-progress REST API controller that fails to perform authorization checks. Unauthenticated attackers can read any user's course-progress records and permanently delete them through this endpoint. The flaw stems from a broken access control implementation in the REST controller responsible for course-progress operations.

Critical Impact
Unauthenticated remote attackers can enumerate, read, and permanently delete course-progress records belonging to any user on affected Masteriyo LMS installations.

Affected Products

Masteriyo LMS WordPress plugin versions before 2.2.1
WordPress sites running Masteriyo LMS with the course-progress REST API enabled
Learning management deployments built on vulnerable Masteriyo releases

Discovery Timeline

2026-06-25 - CVE-2026-10824 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-10824

Vulnerability Analysis

The vulnerability is a missing authorization flaw [CWE-862] in a REST API controller that manages course-progress records. WordPress REST controllers must implement a permission_callback that verifies the caller's identity and capability for the requested action. The Masteriyo course-progress controller registers routes without enforcing this check. Any HTTP client can invoke the endpoints without authentication or session context.

Because the controller exposes both read and delete operations, the impact extends beyond information disclosure. An attacker can iterate through user or progress identifiers and issue delete requests against each one. The deletion is permanent and removes legitimate learner progress records from the database. Course completion data, quiz progress, and related learner state are subject to destruction.

The WPScan advisory identifies version 2.2.1 as the fixed release. Sites running earlier versions remain exposed until upgraded. The EPSS exploit probability score sits at 0.136% at publication time.

Root Cause

The root cause is the absence of capability checks in the REST route registration for the course-progress controller. The permission_callback either returns true, returns __return_true, or is omitted entirely. WordPress treats such routes as publicly accessible regardless of the HTTP method or sensitivity of the underlying operation.

Attack Vector

The attack vector is network-based and requires no authentication, user interaction, or privileges. An attacker sends crafted HTTP requests directly to the plugin's REST API namespace. GET requests return progress data for arbitrary user identifiers. DELETE requests remove the targeted records. The vulnerability mechanism is documented in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-10824

Indicators of Compromise

Unauthenticated HTTP requests to the Masteriyo course-progress REST namespace from unfamiliar IP addresses
Unexpected DELETE method calls targeting /wp-json/ routes associated with the Masteriyo plugin
Reports from learners of lost course-progress, quiz results, or completion records
Sequential enumeration patterns against numeric identifiers in course-progress endpoints

Detection Strategies

Review web server access logs for requests to Masteriyo REST routes that lack authentication cookies or nonces
Correlate database deletions in course-progress tables with the originating HTTP request and source IP
Alert on anomalous spikes of REST API requests from a single client to the Masteriyo plugin endpoints
Audit installed plugin versions across the WordPress estate and flag Masteriyo LMS releases below 2.2.1

Monitoring Recommendations

Forward WordPress and web server logs to a centralized analytics platform for retention and search
Track baseline rates of course-progress REST traffic and alert on deviations
Monitor the WordPress audit log for unexpected data removal events in plugin-managed tables
Subscribe to WPScan and vendor advisory feeds to receive future Masteriyo LMS notifications

How to Mitigate CVE-2026-10824

Immediate Actions Required

Upgrade the Masteriyo LMS plugin to version 2.2.1 or later on all WordPress installations
Inventory course-progress records and confirm integrity against backups before applying changes
Restrict access to /wp-json/ from untrusted networks while patching is in progress
Review web server logs for prior exploitation attempts against the affected REST routes

Patch Information

The vendor fixed the issue in Masteriyo LMS version 2.2.1 by adding authorization checks to the course-progress REST controller. Administrators should update through the WordPress plugin dashboard or via WP-CLI. Reference the WPScan Vulnerability Report for full advisory details.

Workarounds

Temporarily disable the Masteriyo LMS plugin until the upgrade can be completed
Use a web application firewall rule to block unauthenticated requests to Masteriyo course-progress REST routes
Limit access to the WordPress REST API at the reverse proxy layer for sites that do not require public REST access
Maintain frequent database backups of course-progress tables to enable recovery if deletions occur

bash

# Update the Masteriyo LMS plugin using WP-CLI
wp plugin update learning-management-system --version=2.2.1
wp plugin list --name=learning-management-system --fields=name,status,version