CVE-2026-82848: Masteriyo LMS Information Disclosure Flaw

CVE-2026-82848 Overview

CVE-2026-82848 is a missing authorization vulnerability [CWE-862] in the Masteriyo LMS WordPress plugin before version 3.4.0. The plugin exposes course enrolment records through a REST API endpoint without verifying whether the requester has permission to view them. Unauthenticated attackers can enumerate sequential record identifiers to read any learner's enrolment status, timestamps, and course-progress data. Authenticated learners can also retrieve records belonging to other users. The issue affects the confidentiality of learner data across sites running the plugin.

Critical Impact
Unauthenticated attackers can harvest enrolment records, learner activity timestamps, and course-progress data by walking sequential IDs against the plugin's REST API.

Affected Products

Masteriyo LMS WordPress plugin versions before 3.4.0
WordPress sites exposing the plugin's REST API endpoints
Learning management deployments relying on Masteriyo enrolment data

Discovery Timeline

2026-09-09 - CVE-2026-82848 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-82848

Vulnerability Analysis

The Masteriyo LMS plugin registers REST API routes that return course enrolment records identified by an integer primary key. The route handler returns the record without evaluating a permission_callback or equivalent authorization step. Any HTTP client can request a record by ID and receive the associated learner data.

Because identifiers are sequential, an attacker can iterate from 1 upward and enumerate the full enrolment table. Returned fields include enrolment status, creation and update timestamps, and course-progress indicators. A secondary gap allows any authenticated enrolled user to read enrolment records belonging to other learners through the same code path.

Root Cause

The root cause is a missing authorization check in the REST controller responsible for enrolment records. The endpoint accepts a record identifier and returns the object without confirming that the caller owns the record or holds an administrative role. This maps directly to CWE-862: Missing Authorization.

Attack Vector

Exploitation occurs over the network with no authentication and no user interaction. An attacker issues sequential GET requests to the vulnerable REST route and parses the JSON response for each valid identifier. The confidentiality impact is limited to enrolment metadata rather than credentials or arbitrary site data, but the volume of exposed records scales with the size of the learner base. See the WPScan Vulnerability Report for endpoint details.

Detection Methods for CVE-2026-82848

Indicators of Compromise

Sequential REST API requests to Masteriyo enrolment endpoints from a single source IP within a short time window
Unauthenticated GET requests returning HTTP 200 for enrolment record IDs incrementing by one
Unusual outbound data volume from the WordPress host correlated with REST traffic spikes

Detection Strategies

Parse WordPress and web server access logs for requests to /wp-json/masteriyo/ routes referencing enrolment resources
Alert on high-cardinality enumeration patterns where a client requests many distinct numeric IDs on the same route
Correlate REST API responses returning learner PII with requests lacking valid authentication cookies or nonces

Monitoring Recommendations

Enable verbose REST API request logging at the reverse proxy or WAF layer
Track baseline request rates for the Masteriyo plugin and flag deviations
Monitor for user accounts querying enrolment records belonging to other users

How to Mitigate CVE-2026-82848

Immediate Actions Required

Upgrade the Masteriyo LMS plugin to version 3.4.0 or later on all WordPress sites
Audit REST API access logs for prior enumeration attempts against enrolment endpoints
Rotate any secrets or session tokens if exposed enrolment data included sensitive fields

Patch Information

The vendor addressed the missing authorization check in Masteriyo LMS 3.4.0. The fix introduces authorization enforcement on the enrolment REST route so that only the record owner or a privileged user can retrieve a given record. Confirm the plugin version under Plugins > Installed Plugins in the WordPress admin console after updating. Additional detail is available in the WPScan Vulnerability Report.

Workarounds

Restrict access to /wp-json/masteriyo/* routes at the WAF or reverse proxy until the plugin is upgraded
Deny unauthenticated requests to Masteriyo REST endpoints using a WordPress security plugin
Rate-limit REST API traffic to slow enumeration of sequential record identifiers

bash

# Example nginx rule to block unauthenticated access to Masteriyo REST routes
location ~ ^/wp-json/masteriyo/ {
    if ($http_cookie !~* "wordpress_logged_in") {
        return 401;
    }
    limit_req zone=api burst=10 nodelay;
}