PT-2026-28184 · WordPress · Masteriyo Lms Plugin

Hunter Jensen · Publicado 2026-03-26 · Atualizado 2026-03-26 · CVE-2026-4484

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Masteriyo LMS plugin for WordPress versions prior to 2.1.7

Description The Masteriyo LMS plugin for WordPress is susceptible to a privilege escalation issue. An authenticated attacker with Student-level access or higher can elevate their privileges to that of an administrator. This is possible due to the plugin allowing a user to update their user role through the InstructorsController::prepare object for database function. The vulnerable API endpoint is not explicitly mentioned. The vulnerable parameter is not explicitly mentioned.

Recommendations Update the Masteriyo LMS plugin to version 2.1.7 or later.

Correção

LPE

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-4484

Produtos afetados

Masteriyo Lms Plugin

Referências · 11

• https://plugins.trac.wordpress.org/browser/learning-management-system/tags/2.1.6/includes/RestApi/Controllers/Version1/InstructorsController.php#L305 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/265be0af-66a4-4636-ab81-f8e2c5a1282e?source=cve · Nota
• https://twitter.com/OrizonCyber/status/2036994059839901698 · Publicação no Twitter
• https://twitter.com/Nxploited/status/2037053437930594352 · Publicação no Twitter
• https://twitter.com/0dayPublishing/status/2036981272979849350 · Publicação no Twitter
• https://twitter.com/fernandokarl/status/2037186632365781184 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2036997307158220835 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2037137760096579966 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-4484 · Nota de Segurança
• https://plugins.trac.wordpress.org/changeset/3490792/learning-management-system/trunk/includes/RestApi/Controllers/Version1/InstructorsController.php · Nota
• https://twitter.com/TheHackerWire/status/2037001547750793410 · Publicação no Twitter