CVE-2026-10824 Masteriyo LMS < 2.2.1 - Unauthenticated Course Progress Disclosure and Deletion
Unauthenticated attackers can read and delete any user's course progress records in the Masteriyo LMS WordPress plugin due to missing authorization checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-10824?
CVE-2026-10824 is a medium-severity missing authorization vulnerability in Unknown Masteriyo LMS, published on 25 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Masteriyo LMS WordPress plugin before 2.2.1 does not perform authorization checks in a course-progress REST API controller, allowing unauthenticated users to read and permanently delete any user's course-progress records.
Which versions are affected by CVE-2026-10824?
How do I fix CVE-2026-10824?
No fix has been published for CVE-2026-10824 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-10824 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-10824 exists.
Sources
Also known as GHSA-xp2v-x6vp-vp42.