CVE-2026-11773mediumCWE-862

CVE-2026-11773: falha de média gravidade em Masteriyo LMS – LMS Course Builder, Quizzes &…

Masteriyo LMS <= 2.2.1 - Missing Authorization to Authenticated (Student+) Arbitrary Course Announcement Modification

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Masteriyo LMS – LMS Course Builder, Quizzes & Certificates

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.3epss 0.3%
The Masteriyo LMS – LMS Course Builder, Quizzes & Certificates plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with student-level access and above, to modify the description (post content) of arbitrary course announcements authored by instructors or administrators.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
masteriyo · Masteriyo LMS – LMS Course Builder, Quizzes & Certificates
CVEs relacionadas — Masteriyo LMS – LMS Course Builder, Quizzes &…

No mesmo produto, das mais perigosas para as menos.

CVE-2026-8279MEDIUMMasteriyo LMS <= 2.2.0 - Missing Authorization to Unauthenticated Arbitrary Course Progress DeletionEPSS 0.4%