CyberSecBulletin

Masteriyo LMS vulnerabilities

We track 2 vulnerabilities in Masteriyo LMS products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on September 12, 2026.

2vulnerabilities
2critical
0high
0exploited
9.5average CVSS score

Latest Masteriyo LMS vulnerabilities

  • 9.9 Critical severity

    Masteriyo LMS: Deserialization of Untrusted Data

    CVE-2026-82845Masteriyo LMS

    The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowing users with a minimal account to inject arbitrary PHP objects and, by way of a class shipped in a li

  • 9.1 Critical severity

    Masteriyo LMS: Improper Authentication

    CVE-2026-13332Masteriyo LMS

    The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessions, allowing unauthenticated attackers to terminate the active sessions (force-logout) of any user on the site, i