CVE-2026-73996: Masteriyo LMS Auth Bypass Vulnerability

CVE-2026-73996 Overview

CVE-2026-73996 is an unauthenticated arbitrary file upload vulnerability in the Masteriyo Learning Management System (LMS) plugin for WordPress. The flaw affects all versions up to and including 2.3.2. Attackers can upload arbitrary files without authentication, enabling remote code execution on the underlying WordPress host.

The vulnerability maps to [CWE-434: Unrestricted Upload of File with Dangerous Type]. Successful exploitation results in full compromise of the WordPress site and its hosting environment.

Critical Impact
Unauthenticated attackers can upload executable files (such as PHP web shells) to vulnerable Masteriyo LMS installations, achieving remote code execution and full site takeover.

Affected Products

Masteriyo LMS WordPress plugin versions <= 2.3.2
WordPress sites running the Learning Management System plugin by Masteriyo
Any environment exposing the vulnerable plugin endpoints to the internet

Discovery Timeline

2026-08-18 - CVE-2026-73996 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-73996

Vulnerability Analysis

The Masteriyo LMS plugin exposes a file upload endpoint that fails to enforce authentication and does not properly validate file types. An unauthenticated attacker can send a crafted HTTP request to the vulnerable endpoint and place a file of arbitrary type and content within the WordPress uploads directory or another writable location.

Because WordPress executes PHP files from the web root, an attacker who uploads a .php payload can retrieve it over HTTP and trigger code execution in the context of the web server user. This grants the attacker the ability to read site secrets, pivot to the database, and establish persistence.

The issue is network-reachable, requires no privileges, and needs no user interaction. Public technical details are documented in the Patchstack Vulnerability Report.

Root Cause

The root cause is missing authorization and insufficient file-type validation on an upload handler. The plugin does not verify a valid nonce or capability check before accepting the uploaded content. It also fails to enforce a strict allowlist of MIME types and file extensions, permitting server-executable formats such as PHP to be written to disk.

Attack Vector

Exploitation is performed over the network by issuing a multipart HTTP POST request to the vulnerable Masteriyo LMS endpoint. The attacker attaches a PHP payload with a permitted-looking name or content type, then requests the uploaded file directly from the WordPress uploads path. No credentials, session, or user interaction are required.

See the Patchstack Vulnerability Report for advisory-level technical details. No verified public proof-of-concept code is available at this time.

Detection Methods for CVE-2026-73996

Indicators of Compromise

Unexpected files with executable extensions (.php, .phtml, .phar) inside wp-content/uploads/ or Masteriyo-specific upload directories
HTTP POST requests to Masteriyo LMS upload endpoints from unauthenticated sources with multipart/form-data bodies
New administrative WordPress users, modified wp-config.php, or unexpected cron entries following upload events
Outbound connections from the web server process to unfamiliar hosts shortly after suspicious POST requests

Detection Strategies

Inspect web server access logs for POST requests to Masteriyo plugin routes containing multipart/form-data and uncommon file extensions
Run file integrity monitoring across wp-content/plugins/learning-management-system/ and wp-content/uploads/ for newly written PHP files
Correlate web request logs with process execution telemetry to identify PHP interpreter invocations spawning shells or network utilities

Monitoring Recommendations

Enable WordPress audit logging for plugin activity and file uploads
Alert on php process ancestry originating from web server workers spawning sh, bash, curl, or wget
Monitor for creation of files with double extensions such as image.jpg.php in uploads directories

How to Mitigate CVE-2026-73996

Immediate Actions Required

Update the Masteriyo LMS plugin to a version later than 2.3.2 as soon as a patched release is confirmed by the vendor via the Patchstack advisory
Audit wp-content/uploads/ and Masteriyo upload paths for unauthorized PHP files and remove any that are found
Rotate WordPress administrator passwords, API keys stored in wp-config.php, and database credentials if compromise is suspected

Patch Information

Refer to the Patchstack Vulnerability Report for the current patch status. Administrators should apply the vendor-supplied fixed release once available and verify the installed plugin version through the WordPress admin dashboard.

Workarounds

Deactivate and remove the Masteriyo LMS plugin until a patched version is installed
Deploy a web application firewall rule that blocks unauthenticated POST requests to Masteriyo upload endpoints
Configure the web server to deny execution of PHP files within wp-content/uploads/ using directory-level rules

bash

# Apache: prevent PHP execution inside the WordPress uploads directory
# Place in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar|php[0-9])$">
    Require all denied
</FilesMatch>

# Nginx equivalent (in server or location block)
location ~* /wp-content/uploads/.*\.(php|phtml|phar|php[0-9])$ {
    deny all;
    return 403;
}