CVE-2026-8279: Masteriyo LMS WordPress Auth Bypass Flaw

CVE-2026-8279 Overview

CVE-2026-8279 is a missing authorization vulnerability in the Masteriyo LMS plugin for WordPress. The flaw resides in the delete_item_permissions_check function of the CourseProgressItemsController class. All plugin versions up to and including 2.2.0 fail to verify caller privileges before processing REST API delete requests. Unauthenticated attackers can delete arbitrary course progress records belonging to any student on the affected site. The weakness is categorized under CWE-862: Missing Authorization and impacts data integrity across learning management deployments that rely on this plugin.

Critical Impact
Unauthenticated attackers can remotely delete arbitrary student course progress records through an exposed REST API endpoint, corrupting learning records without any user interaction.

Affected Products

Masteriyo LMS plugin for WordPress (learning-management-system)
All versions up to and including 2.2.0
REST API CourseProgressItemsController (Version1)

Discovery Timeline

2026-09-07 - CVE-2026-8279 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-8279

Vulnerability Analysis

The Masteriyo LMS plugin exposes a REST API route to delete individual course progress items. The permissions callback bound to that route, delete_item_permissions_check, does not perform a capability or ownership check against the requesting user. As a result, the endpoint accepts anonymous DELETE requests and forwards them to the underlying repository logic that removes course progress records from the database.

An unauthenticated attacker can iterate through course progress item IDs and issue delete requests against the vulnerable REST route. Each request removes a legitimate student's tracking record, disrupting course completion state, certificates, and downstream reporting that depends on those rows.

The vulnerability is limited to integrity impact; it does not expose data or crash the site. However, at scale it enables silent, targeted destruction of learner history, which is difficult for site administrators to reconstruct without backups.

Root Cause

The root cause is a missing authorization check [CWE-862] in the REST controller. The delete_item_permissions_check function returns a permissive result instead of validating that the current user owns the record or holds an administrative capability such as manage_options or a Masteriyo-specific instructor capability. See the WordPress LMS Course Progress Controller v1 source and the repository delete logic for the affected code paths.

Attack Vector

Exploitation is network-based and requires no authentication or user interaction. The attacker sends an HTTP DELETE request to the plugin's REST API endpoint that handles course progress items, supplying the numeric identifier of the target record. The vulnerable permissions callback approves the request, and the repository layer executes the delete. Attackers can enumerate identifiers sequentially to erase progress across an entire course catalog.

Because the endpoint sits behind the standard WordPress REST API surface, requests are indistinguishable from ordinary plugin traffic without payload inspection.

Detection Methods for CVE-2026-8279

Indicators of Compromise

Unauthenticated DELETE requests to /wp-json/masteriyo/v1/course-progress-items/ REST routes in web server logs
Sudden drops in course progress records or student completion metrics without administrator activity
Sequential numeric enumeration of course progress item IDs from a single source IP
Missing X-WP-Nonce header or absent authentication cookies on successful DELETE responses

Detection Strategies

Review WordPress access logs for DELETE verbs targeting Masteriyo REST endpoints originating from unauthenticated sessions
Correlate database audit logs for DELETE statements against the course progress items table with corresponding HTTP requests
Deploy Web Application Firewall (WAF) rules that alert on unauthenticated calls to /wp-json/masteriyo/v1/course-progress-items/*

Monitoring Recommendations

Enable WordPress activity logging plugins to capture REST API calls that mutate course data
Baseline normal course progress deletion volume and alert on anomalies
Forward web server and plugin logs to a centralized SIEM for correlation with authentication events

How to Mitigate CVE-2026-8279

Immediate Actions Required

Upgrade the Masteriyo LMS plugin to a version above 2.2.0 once the vendor publishes a patched release
Restrict access to the /wp-json/masteriyo/v1/course-progress-items/ REST route at the WAF or reverse proxy layer until patched
Back up the course progress database tables so that any deleted records can be restored
Audit recent web server logs for suspicious DELETE requests against the affected endpoint

Patch Information

At the time of NVD publication, no fixed version is listed in the enriched data. Refer to the Wordfence Vulnerability Report for updates on vendor remediation and confirmed fixed versions. Administrators should monitor the Masteriyo plugin changelog on the WordPress plugin directory and apply the update as soon as it becomes available.

Workarounds

Disable the Masteriyo LMS plugin on sites where course progress tracking is not actively required
Add a WAF rule that blocks DELETE requests to /wp-json/masteriyo/v1/course-progress-items/* originating from unauthenticated clients
Use a WordPress security plugin to require authentication on all REST API routes exposed by the plugin
Implement daily database snapshots for the affected tables to enable rapid restoration if records are deleted

bash

# Example NGINX rule to block unauthenticated DELETE to the vulnerable endpoint
location ~ ^/wp-json/masteriyo/v1/course-progress-items/ {
    if ($request_method = DELETE) {
        return 403;
    }
}