Masteriyo
Vulnerability activity for Masteriyo: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 1
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 4
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 4
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 6.5MediumOct 30, 2026Masteriyo - LMS Auth bypass / access controlCVE-2026-116410Unauthenticated Arbitrary Content Deletion in Masteriyo - LMS <= 3.4.3 versions.
- 5.3MediumSep 11, 2026Masteriyo - LMS Auth bypass / access controlCVE-2026-62132Subscriber Broken Access Control in Masteriyo - LMS <= 3.4.0 versions.
- 8.8HighSep 11, 2026Masteriyo - LMS DeserializationCVE-2026-62107Unauthenticated PHP Object Injection in Masteriyo - LMS <= 3.4.0 versions.
- 5.3MediumSep 7, 2026Masteriyo LMS – LMS Course Builder, Quizzes & Certificates Auth bypass / access controlCVE-2026-8279The Masteriyo LMS plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the 'delete_item_permissions_check' function in the CourseProgressItemsController in all versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to delete arbitrary course progress records belonging to any student.
Top products
- Masteriyo - LMS3 CVEs in the last year
- Masteriyo LMS – LMS Course Builder, Quizzes & Certificates1 CVE in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.