{“lastseen”:””,”description”:”The Masteriyo LMS \u2013 LMS Course Builder, Quizzes \\u0026 Certificates plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with student-level access and above, to modify the description (post content) of arbitrary course announcements authored by instructors or administrators.”,”published”:”2026-06-27T06:50:57.531Z”,”modified”:”2026-06-27T06:50:57.531Z”,”type”:”cve”,”title”:”Masteriyo LMS \\u003c= 2.2.1 – Missing Authorization to Authenticated (Student+) Arbitrary Course Announcement Modification”,”source”:”Wordfence”,”references”:”https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/id\/5780d762-2313-4c81-be02-99543359d824?source=cve\\nhttps:\/\/plugins.trac.wordpress.org\/browser\/learning-management-system\/tags\/2.2.1\/addons\/course-announcement\/Controllers\/CourseAnnouncementController.php#L782\\nhttps:\/\/plugins.trac.wordpress.org\/browser\/learning-management-system\/tags\/2.2.1\/addons\/course-announcement\/Controllers\/CourseAnnouncementController.php#L619\\nhttps:\/\/plugins.trac.wordpress.org\/browser\/learning-management-system\/tags\/2.1.8\/addons\/course-announcement\/Controllers\/CourseAnnouncementController.php#L782\\nhttps:\/\/plugins.trac.wordpress.org\/browser\/learning-management-system\/tags\/2.1.8\/addons\/course-announcement\/Controllers\/CourseAnnouncementController.php#L619\\nhttps:\/\/plugins.trac.wordpress.org\/changeset?sfp_email=\\u0026sfph_mail=\\u0026reponame=\\u0026old=3583519%40learning-management-system\\u0026new=3583519%40learning-management-system\\u0026sfp_email=\\u0026sfph_mail=”,”id”:”CVE-2026-11773″,”bulletinFamily”:””,”cwe”:[“CWE-862″],”cvelist”:null,”sourceData”:”masteriyo Masteriyo LMS \u2013 LMS Course Builder, Quizzes \\u0026 Certificates 0″,”sourceHref”:””,”cvss”:{“score”:4.3,”severity”:”MEDIUM”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:N\/I:L\/A:N”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:””,”category_name”:”CVE”,”post_link”:””,”product”:”Masteriyo LMS \u2013 LMS Course Builder, Quizzes \\u0026 Certificates”,”version”:”0″,”vendor”:”masteriyo”,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:””,”description”:”The Masteriyo LMS \u2013 LMS Course Builder, Quizzes \\u0026 Certificates plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including,…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[6,8,123,12,21,13,7,11,5],"class_list":["post-66401","post","type-post","status-publish","format-standard","hentry","category-category_cve","tag-cve","tag-cvss","tag-cvss-43","tag-exploit","tag-medium","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n