Masteriyo LMS – LMS Course Builder, Quizzes & Certificates

Software Type	Plugin
Software Slug	learning-management-system (view on wordpress.org)
Software Status	Active
Software Author	masteriyo
Software Website	masteriyo.com
Software Downloads	288,501
Software Active Installs	5,000
Software Record Last Updated	July 22, 2026

16 Vulnerabilities

Submit a Vulnerability

Masteriyo LMS <= 2.2.1 - Missing Authorization to Authenticated (Student+) Arbitrary Course Announcement Modification

4.3

CVE-2026-11773

Jun 26, 2026

Researcher: ilinor

Masteriyo LMS – LMS Course Builder, Quizzes & Certificates <= 2.2.0 - Authenticated (Subscriber+) Privilege Escalation

8.8

CVE-2026-49111

Jun 8, 2026

Researcher: daroo

Masteriyo LMS – LMS Course Builder, Quizzes & Certificates <= 2.1.8 - Missing Authorization

5.3

CVE-2026-42743

May 28, 2026

Researcher: HieuPenguin

Masteriyo LMS – Online Course Builder for eLearning, LMS & Education <= 2.1.5 - Missing Authorization

5.3

CVE-2026-39524

Apr 8, 2026

Researcher: davidfdzmorilla

Masteriyo LMS <= 2.1.7 - Unauthenticated Authorization Bypass to Arbitrary Order Completion via Stripe Webhook Endpoint

5.3

CVE-2026-5167

Apr 7, 2026

Researcher: Md. Moniruzzaman Prodhan (NomanProdhan)

Masteriyo LMS <= 2.1.6 - Missing Authorization to Authenticated (Student+) Privilege Escalation to Administrator

8.8

CVE-2026-4484

Mar 25, 2026

Researcher: Hunter Jensen (skid)

Masteriyo - LMS <= 2.0.3 - Authenticated (Subscriber+) Sensitive Information Exposure

4.3

CVE-2025-64270

Nov 30, 2025

Researcher: daroo

Masteriyo - LMS <= 1.18.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVE-2025-54699

Jul 30, 2025

Researcher: Denver Jackson

Masteriyo LMS – eLearning and Online Course Builder for WordPress <= 1.13.3 - Authenticated (Student+) Stored Cross-Site Scripting via Ask a Question Functionality

6.4

CVE-2024-10000

Oct 28, 2024

Researcher: floerer

Masteriyo LMS – eLearning and Online Course Builder for WordPress <= 1.13.3 - Authenticated (Student+) Missing Authorization to Privilege Escalation

8.8

CVE-2024-10008

Oct 28, 2024

Researcher: floerer

Masteriyo - LMS <= 1.11.4 - Authenticated (Student+) Insecure Direct Object Reference

5.3

CVE-2024-43239

Aug 12, 2024

Researcher: Ananda Dhakal

Masteriyo - LMS <= 1.11.6 - Missing Authorization

5.3

CVE-2024-43159

Aug 7, 2024

Researcher: Ananda Dhakal

Masteriyo - LMS <= 1.11.4 - Missing Authorization

5.3

CVE-2024-43158

Aug 7, 2024

Researcher: Ananda Dhakal

Masteriyo - LMS <= 1.7.3 - Insecure Direct Object Reference

5.3

CVE-2024-33939

Apr 30, 2024

Researcher: Steven Julian

Masteriyo - LMS <= 1.7.2 - Unauthenticated Privilege Escalation

9.8

CVE-2024-24882

Apr 5, 2024

Researcher: Steven Julian

Masteriyo - LMS for WordPress <= 1.6.7 - Sensitive Information Exposure

6.5

CVE-2023-3345

Jul 3, 2023

Researcher: Yassir Sbai Fahim (iduzzel)

Title	Status	CVE ID	CVSS	Researchers	Date
Masteriyo LMS <= 2.2.1 - Missing Authorization to Authenticated (Student+) Arbitrary Course Announcement Modification	Patched	CVE-2026-11773	4.3	ilinor	June 26, 2026
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates <= 2.2.0 - Authenticated (Subscriber+) Privilege Escalation	Patched	CVE-2026-49111	8.8	daroo	June 8, 2026
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates <= 2.1.8 - Missing Authorization	Patched	CVE-2026-42743	5.3	HieuPenguin	May 28, 2026
Masteriyo LMS – Online Course Builder for eLearning, LMS & Education <= 2.1.5 - Missing Authorization	Patched	CVE-2026-39524	5.3	davidfdzmorilla	April 8, 2026
Masteriyo LMS <= 2.1.7 - Unauthenticated Authorization Bypass to Arbitrary Order Completion via Stripe Webhook Endpoint	Patched	CVE-2026-5167	5.3	Md. Moniruzzaman Prodhan (NomanProdhan)	April 7, 2026
Masteriyo LMS <= 2.1.6 - Missing Authorization to Authenticated (Student+) Privilege Escalation to Administrator	Patched	CVE-2026-4484	8.8	Hunter Jensen (skid)	March 25, 2026
Masteriyo - LMS <= 2.0.3 - Authenticated (Subscriber+) Sensitive Information Exposure	Patched	CVE-2025-64270	4.3	daroo	November 30, 2025
Masteriyo - LMS <= 1.18.3 - Authenticated (Contributor+) Stored Cross-Site Scripting	Patched	CVE-2025-54699	6.4	Denver Jackson	July 30, 2025
Masteriyo LMS – eLearning and Online Course Builder for WordPress <= 1.13.3 - Authenticated (Student+) Stored Cross-Site Scripting via Ask a Question Functionality	Patched	CVE-2024-10000	6.4	floerer	October 28, 2024
Masteriyo LMS – eLearning and Online Course Builder for WordPress <= 1.13.3 - Authenticated (Student+) Missing Authorization to Privilege Escalation	Patched	CVE-2024-10008	8.8	floerer	October 28, 2024
Masteriyo - LMS <= 1.11.4 - Authenticated (Student+) Insecure Direct Object Reference	Patched	CVE-2024-43239	5.3	Ananda Dhakal	August 12, 2024
Masteriyo - LMS <= 1.11.6 - Missing Authorization	Patched	CVE-2024-43159	5.3	Ananda Dhakal	August 7, 2024
Masteriyo - LMS <= 1.11.4 - Missing Authorization	Patched	CVE-2024-43158	5.3	Ananda Dhakal	August 7, 2024
Masteriyo - LMS <= 1.7.3 - Insecure Direct Object Reference	Patched	CVE-2024-33939	5.3	Steven Julian	April 30, 2024
Masteriyo - LMS <= 1.7.2 - Unauthenticated Privilege Escalation	Patched	CVE-2024-24882	9.8	Steven Julian	April 5, 2024
Masteriyo - LMS for WordPress <= 1.6.7 - Sensitive Information Exposure	Patched	CVE-2023-3345	6.5	Yassir Sbai Fahim (iduzzel)	July 3, 2023

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation