CVE-2026-11773: Masteriyo LMS Auth Bypass Vulnerability

CVE-2026-11773 Overview

CVE-2026-11773 is an authorization bypass vulnerability in the Masteriyo LMS – LMS Course Builder, Quizzes & Certificates plugin for WordPress. The flaw affects all versions up to and including 2.2.1. The plugin fails to properly verify whether an authenticated user is permitted to modify course announcement content. Attackers with student-level access or higher can alter the post content of arbitrary course announcements authored by instructors or administrators. The issue maps to Missing Authorization [CWE-862] and is reachable over the network with low privileges.

Critical Impact
Authenticated users with minimal (student) privileges can tamper with course announcements published by instructors and administrators, undermining course integrity and trust.

Affected Products

Masteriyo LMS – LMS Course Builder, Quizzes & Certificates plugin for WordPress
All versions up to and including 2.2.1
WordPress sites using the course-announcement addon

Discovery Timeline

2026-06-27 - CVE-2026-11773 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-11773

Vulnerability Analysis

The vulnerability resides in the CourseAnnouncementController.php file of the plugin's course-announcement addon. The controller handles REST API requests for creating, updating, and listing course announcements. The update handler does not verify that the authenticated user owns the announcement or holds an instructor-equivalent role before persisting changes to the announcement's post_content. As a result, any authenticated account, including the student role, can submit an update request and modify announcements authored by other users.

The practical impact is content tampering. An attacker can rewrite instructor or administrator announcements to spread misinformation, replace legitimate URLs with phishing links, or damage the integrity of course communications. The vulnerability does not directly permit account takeover, code execution, or data exfiltration, but it does undermine trust in learning content delivered through the plugin.

Root Cause

The root cause is a Missing Authorization check [CWE-862] in the announcement update endpoint. The plugin verifies that a request is authenticated but does not evaluate whether the caller has the capability to edit the specific announcement being modified. Ownership and role checks that should gate write operations are absent from the controller logic referenced at lines 619 and 782 of CourseAnnouncementController.php.

Attack Vector

Exploitation requires an authenticated session with student-level access on a vulnerable WordPress site. The attacker sends a crafted REST API request targeting the announcement update route and supplies the identifier of an announcement authored by an instructor or administrator, along with attacker-controlled post_content. Because the plugin skips the authorization check, the request succeeds and the announcement is rewritten. See the WordPress Code Reference Line 619 (v2.2.1) and Wordfence Vulnerability Information for technical details.

Detection Methods for CVE-2026-11773

Indicators of Compromise

Unexpected edits to post_content on course announcement posts, especially when the last-modifying user holds only a student role.
REST API requests to the Masteriyo announcement update endpoint originating from low-privileged accounts.
Sudden appearance of external URLs, redirects, or unrelated messaging inside previously legitimate course announcements.

Detection Strategies

Audit the WordPress wp_posts and wp_postmeta tables for announcement posts whose post_modified timestamp differs from post_date and whose editor differs from the original author.
Enable REST API request logging and flag POST/PUT calls to Masteriyo announcement routes made by accounts without instructor or administrator capabilities.
Review web server access logs for repeated calls to the plugin's announcement endpoints from a single authenticated session.

Monitoring Recommendations

Alert on WordPress role-versus-action mismatches, such as student accounts writing to instructor-authored content.
Track version drift of the Masteriyo LMS plugin across managed WordPress sites and flag hosts running 2.2.1 or earlier.
Correlate authentication events with content modification events to surface abuse patterns from newly registered student accounts.

How to Mitigate CVE-2026-11773

Immediate Actions Required

Update the Masteriyo LMS plugin to a version later than 2.2.1 that includes the fix referenced in the WordPress Changeset Overview.
Review recently modified course announcements and restore any content altered by non-instructor accounts.
Audit student-role accounts for suspicious registration patterns and revoke access where warranted.

Patch Information

The vendor addressed the missing authorization check in a subsequent release of the Masteriyo LMS plugin. The fix is tracked in the plugin repository under changeset 3583519 and modifies the announcement controller to enforce proper capability and ownership checks before allowing updates. Site administrators should upgrade through the WordPress plugin update mechanism and verify the installed version is above 2.2.1.

Workarounds

Temporarily disable the course-announcement addon within the Masteriyo LMS plugin settings until the patched version is deployed.
Restrict new user registration or require administrator approval for student accounts on public-facing LMS sites.
Place a web application firewall rule in front of the Masteriyo announcement REST endpoints to block write requests from sessions lacking instructor-level capability claims.

bash

# Configuration example
# Update the Masteriyo LMS plugin via WP-CLI
wp plugin update learning-management-system
wp plugin get learning-management-system --field=version