medium6.5
CVE-2026-10824
The Masteriyo LMS WordPress plugin before 2.2.1 does not perform authorization checks in a course-progress REST API controller, allowing unauthenticated users …
Impact
The Masteriyo LMS WordPress plugin before 2.2.1 does not perform authorization checks in a course-progress REST API controller, allowing unauthenticated users to read and permanently delete any user's course-progress records.
Affected products
| Product | Affected versions |
|---|---|
| Masteriyo LMS WordPress Plugin | before 2.2.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.