vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-11773

Masteriyo LMS <= 2.2.1 - Missing Authorization to Authenticated (Student+) Arbitrary Course Announcement Modification

MEDIUM
4.3
CVSS Score
Published: June 27, 2026 at 06:50 AM UTC
Updated: July 1, 2026 at 11:22 PM UTC
1 product affected across 1 vendorMasteriyo

Using Masteriyo LMS – LMS Course Builder, Quizzes & Certificates by masteriyo?

Get instant alerts when new vulnerabilities affect Masteriyo LMS – LMS Course Builder, Quizzes & Certificates - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM4.3
Exploit prediction
EPSS 0.3%
SSVC
No known exploit

Description

The Masteriyo LMS – LMS Course Builder, Quizzes & Certificates plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with student-level access and above, to modify the description (post content) of arbitrary course announcements authored by instructors or administrators.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Masteriyo· Masteriyowordpress-plugin
60%
v ≤ 2.2.1

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (6)

Source: cverecord
https://www.wordfence.com/threat-intel/vulnerabilities/id/5780d762-2313-4c81-be02-99543359d824?source=cve
Source: cverecord
https://plugins.trac.wordpress.org/browser/learning-management-system/tags/2.2.1/addons/course-announcement/Controllers/CourseAnnouncementController.php#L782
Source: cverecord
https://plugins.trac.wordpress.org/browser/learning-management-system/tags/2.2.1/addons/course-announcement/Controllers/CourseAnnouncementController.php#L619
Source: cverecord
https://plugins.trac.wordpress.org/browser/learning-management-system/tags/2.1.8/addons/course-announcement/Controllers/CourseAnnouncementController.php#L782
Source: cverecord
https://plugins.trac.wordpress.org/browser/learning-management-system/tags/2.1.8/addons/course-announcement/Controllers/CourseAnnouncementController.php#L619
Source: cverecord
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3583519%40learning-management-system&new=3583519%40learning-management-system&sfp_email=&sfph_mail=

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

4.3MEDIUMWordfence
Vector?

Quick Info

StatusDEFERRED
CWE
CWE-862

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card