critical9.1
CVE-2026-13332
The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessions, allowing…
Impact
The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessions, allowing unauthenticated attackers to terminate the active sessions (force-logout) of any user on the site, including administrators.
Affected products
| Product | Affected versions |
|---|---|
| Masteriyo LMS WordPress Plugin | before 2.3.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.