CVE-2026-82850: Masteriyo LMS Information Disclosure Flaw

CVE-2026-82850 Overview

CVE-2026-82850 is an information disclosure vulnerability in the Masteriyo LMS WordPress plugin before version 3.4.2. The plugin fails to restrict access to quiz answer keys, allowing any authenticated user to retrieve correct answers for any quiz on the site. This includes quizzes in courses the user is not enrolled in. The redaction logic that hides answers applies only to a fixed list of question types. Answers for every other question type are returned in full to any user able to view the questions. The flaw is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Authenticated users, including students, can retrieve correct quiz answers for any course on the site, undermining academic integrity across all learners using the platform.

Affected Products

Masteriyo LMS WordPress plugin versions before 3.4.2
WordPress sites running vulnerable Masteriyo LMS installations
Any learning management system deployment relying on Masteriyo quiz grading

Discovery Timeline

2026-09-24 - CVE-2026-82850 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-82850

Vulnerability Analysis

The Masteriyo LMS plugin exposes quiz question data through an authenticated endpoint accessible to any logged-in user. The server-side response includes answer key fields alongside question content. A redaction routine strips correct answers before sending the response, but it only operates on a hardcoded set of question types. Question types outside that allowlist bypass redaction entirely and return their answer keys intact.

Access control for the endpoint checks only that the requester is authenticated. The code does not verify course enrollment, quiz ownership, or role before returning question data. A student account can therefore query any quiz on the site, including quizzes in paid courses they have not purchased.

Root Cause

The root cause combines two defects. First, the endpoint lacks authorization checks tied to course enrollment, violating least-privilege access control. Second, the answer-redaction routine uses a type-based allowlist rather than redacting by default and whitelisting fields safe to expose. New or less common question types fall outside the allowlist and leak their answer keys.

Attack Vector

Exploitation requires only a valid low-privilege account such as a student. The attacker sends authenticated requests to the quiz question endpoint, iterating over quiz identifiers to enumerate all quizzes on the site. The response payload contains the correct answers for any question whose type is not in the redaction allowlist. No elevated privileges, user interaction, or specialized tooling are required.

See the WPScan Vulnerability Report for technical details on the vulnerable endpoint and affected question types.

Detection Methods for CVE-2026-82850

Indicators of Compromise

Unusual volume of authenticated requests from a single user account to Masteriyo quiz REST endpoints such as /wp-json/masteriyo/v1/quizes/ or related question-listing routes.
Students accessing quiz data for courses in which they are not enrolled, visible in WordPress access logs or application telemetry.
Sequential enumeration patterns against quiz or question identifiers originating from non-instructor accounts.

Detection Strategies

Review web server access logs for authenticated requests to Masteriyo question endpoints and correlate requester identity against course enrollment records.
Deploy a WordPress security plugin or web application firewall rule that logs REST API calls to the Masteriyo namespace and alerts on high-volume access by non-instructor roles.
Compare quiz performance records against access patterns to identify students who viewed answer-key data before attempting the quiz.

Monitoring Recommendations

Enable verbose logging on the WordPress REST API and forward logs to a centralized analytics platform for retention and query.
Alert on authenticated REST requests to Masteriyo endpoints that return response bodies containing fields such as correct or answer.
Baseline normal quiz-viewing behavior per role and flag deviations from student accounts.

How to Mitigate CVE-2026-82850

Immediate Actions Required

Upgrade the Masteriyo LMS plugin to version 3.4.2 or later on all WordPress sites.
Audit recent quiz submissions for anomalous perfect scores that may indicate pre-exploit answer harvesting.
Rotate or regenerate quizzes for high-stakes assessments conducted while vulnerable versions were in use.

Patch Information

The vendor fixed the issue in Masteriyo LMS version 3.4.2. Site administrators should update through the WordPress plugin dashboard or by replacing the plugin files with the patched release. Confirm the installed version after update by checking the Plugins screen in WordPress admin. Reference the WPScan Vulnerability Report for advisory details.

Workarounds

Restrict access to the WordPress REST API for non-instructor roles using a security plugin or custom rest_authentication_errors filter until the patch is applied.
Temporarily disable the Masteriyo LMS plugin on sites running affected versions where high-stakes assessments are in progress.
Add a web application firewall rule blocking authenticated requests to Masteriyo quiz question endpoints from accounts without an enrollment relationship to the requested course.

bash

# Update Masteriyo LMS using WP-CLI
wp plugin update learning-management-system --version=3.4.2

# Verify installed version
wp plugin get learning-management-system --field=version