PT-2026-28184 · WordPress · Masteriyo Lms Plugin

Hunter Jensen · Published 2026-03-26 · Updated 2026-03-26 · CVE-2026-4484

Positive Technologies · (AI Summary)

CVSS v3.1

9.8

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Masteriyo LMS plugin for WordPress versions prior to 2.1.7

Description The Masteriyo LMS plugin for WordPress is susceptible to a privilege escalation issue. An authenticated attacker with Student-level access or higher can elevate their privileges to that of an administrator. This is possible due to the plugin allowing a user to update their user role through the InstructorsController::prepare object for database function. The vulnerable API endpoint is not explicitly mentioned. The vulnerable parameter is not explicitly mentioned.

Recommendations Update the Masteriyo LMS plugin to version 2.1.7 or later.

Fix

LPE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-4484

Affected Products

Masteriyo Lms Plugin

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-4484 · Security Note
• https://plugins.trac.wordpress.org/browser/learning-management-system/tags/2.1.6/includes/RestApi/Controllers/Version1/InstructorsController.php#L305 · Note
• https://plugins.trac.wordpress.org/changeset/3490792/learning-management-system/trunk/includes/RestApi/Controllers/Version1/InstructorsController.php · Note
• https://twitter.com/CveFindCom/status/2036997307158220835 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/265be0af-66a4-4636-ab81-f8e2c5a1282e?source=cve · Note
• https://twitter.com/TheHackerWire/status/2037001547750793410 · Twitter Post
• https://twitter.com/0dayPublishing/status/2036981272979849350 · Twitter Post
• https://twitter.com/OrizonCyber/status/2036994059839901698 · Twitter Post