CVE-2026-10824

MEDIUM 6.5 PoC AVAILABLE

Published 2026-06-25 · Last modified 2026-06-25

The Masteriyo LMS WordPress plugin before 2.2.1 does not perform authorization checks in a course-progress REST API controller, allowing unauthenticated users to read and permanently delete any user's course-progress records.

EXPLOIT AVAILABLE

Public exploit or PoC code exists. Modeled probability is still low, but the barrier to attack is reduced — watch closely.

Exploitation likelihood

0.2%chance of exploitation in 30 days · 6th percentile

○ In CISA KEV ● Public exploit / PoC

Impact if exploited

6.5CVSS 3.1 · MEDIUM

ConfidentialityLow
IntegrityLow
AvailabilityNone

What an attacker needs

✓Access: Reachable over the network — no local access needed
✓Privileges: No account or privileges required
✓User interaction: No user interaction needed
✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept & exploit code

PoC https://wpscan.com/vulnerability/61d2f6ad-8450-40ae-862d-cafff38c27a0/

Listed for defensive triage and patch prioritization.

Affected

Vendors Unknown

Products Masteriyo Lms

Weakness (CWE)

Not classified.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References

Exploits & PoC

https://wpscan.com/vulnerability/61d2f6ad-8450-40ae-862d-cafff38c27a0/ exploitvdb-entrytechnical-description

Sources: NVD · CVE.org · EPSS