CVE-2026-82849: Masteriyo LMS Information Disclosure Flaw

CVE-2026-82849 Overview

CVE-2026-82849 is an Insecure Direct Object Reference (IDOR) vulnerability [CWE-639] in the Masteriyo LMS WordPress plugin versions before 3.4.2. The plugin fails to verify that a user requesting course-progress records owns those records. Any authenticated user, including a self-registered subscriber, can read another learner's course-progress data. When the requested account identifier is not supplied with a non-zero value, the ownership check is skipped entirely and the plugin returns the course-progress records of every learner on the site in a single response.

Critical Impact
Authenticated low-privilege users can enumerate learning activity for every student registered on an affected Masteriyo LMS site.

Affected Products

Masteriyo LMS WordPress plugin versions prior to 3.4.2
WordPress sites with open subscriber registration running the plugin
Learning platforms using Masteriyo course-progress REST endpoints

Discovery Timeline

2026-09-24 - CVE-2026-82849 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-82849

Vulnerability Analysis

The Masteriyo LMS plugin exposes a course-progress endpoint intended to return records belonging to the requesting user. The endpoint accepts a user identifier parameter and conditionally applies an ownership check. The check only runs when the parameter is present and non-zero. Any authenticated session, including a self-registered subscriber account, can call the endpoint and retrieve another user's learning activity. When the user identifier is omitted or set to zero, the endpoint bypasses filtering and returns progress records for every learner on the site in one response. This exposes course enrollment data, lesson progression, quiz attempts, and completion timestamps across the entire user base.

Root Cause

The vulnerability stems from a missing authorization check on a REST endpoint that returns user-scoped data. The code treats the user identifier parameter as an authorization filter rather than enforcing authorization against the authenticated session. Supplying a different user identifier returns that user's records. Supplying no identifier or a zero value skips the filter and returns all records. This pattern maps directly to CWE-639: Authorization Bypass Through User-Controlled Key.

Attack Vector

Exploitation requires only a valid authenticated session on the target WordPress site. On sites with open registration, attackers create a subscriber account and send a request to the course-progress endpoint. By iterating user identifiers, an attacker enumerates individual learners. By omitting the identifier, an attacker retrieves bulk progress data in one request. No elevated privileges, user interaction, or chained vulnerabilities are required. See the WPScan Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-82849

Indicators of Compromise

Repeated authenticated requests to Masteriyo course-progress REST routes from a single subscriber account
REST requests to the course-progress endpoint with missing or zero-valued user identifier parameters
Unusual response sizes from Masteriyo endpoints indicating bulk record retrieval
Newly registered subscriber accounts issuing API calls within minutes of registration

Detection Strategies

Review WordPress and web server access logs for high-frequency requests to /wp-json/masteriyo/ course-progress routes
Correlate authenticated session identifiers with the number of distinct user records returned per response
Alert on sequential enumeration patterns across the user identifier parameter

Monitoring Recommendations

Enable REST API request logging on the WordPress host and forward to a central log store
Monitor subscriber account creation rates for anomalous spikes
Track response payload sizes for Masteriyo endpoints and alert on outliers

How to Mitigate CVE-2026-82849

Immediate Actions Required

Upgrade the Masteriyo LMS plugin to version 3.4.2 or later on all WordPress installations
Audit subscriber accounts created in the days preceding the patch and remove unknown accounts
Review access logs for prior requests to course-progress endpoints and identify data that may have been exposed

Patch Information

The vendor addressed CVE-2026-82849 in Masteriyo LMS version 3.4.2. The fix enforces that the authenticated user matches the owner of the requested course-progress records and rejects requests that omit or zero out the user identifier. Refer to the WPScan Vulnerability Report for version metadata.

Workarounds

Disable open user registration in WordPress settings until the patch is applied
Restrict access to Masteriyo REST endpoints at the web server or WAF layer, allowing only authenticated requests from known paths
Temporarily deactivate the Masteriyo LMS plugin on sites that cannot upgrade immediately

bash

# Example WAF rule to block unauthenticated or malformed course-progress requests
# Blocks requests missing a valid non-zero user identifier parameter
SecRule REQUEST_URI "@contains /wp-json/masteriyo" \
  "chain,deny,status:403,id:1002849,msg:'Masteriyo course-progress access check'"
  SecRule ARGS:user_id "@rx ^(0|)$"