CVE-2026-82848 — Masteriyo LMS 1.3.1 - 2.3.3 - Unauthenticated Course Enrollment Disclosure

CVE-2026-82848

Masteriyo LMS 1.3.1 - 2.3.3 - Unauthenticated Course Enrollment Disclosure PUBLISHED

Description (CNA)

The Masteriyo LMS WordPress plugin before 3.4.0 does not perform any authorization check before returning a course enrolment record over its REST API, allowing unauthenticated users to read any learner's enrolment status, timestamps and course-progress data by walking sequential record identifiers. A related gap lets any enrolled user retrieve other learners' enrolment records as well.

Affected (CNA)

Vendor / product	Versions
Unknown / Masteriyo LMS	affected 1.3.1 before 3.4.0

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/a6e580be-ce42-479d-97cd-fcfa2f752b2c/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.