Masteriyo LMS 1.3.1 - 2.3.3 - Unauthenticated Course Enrollment Disclosure

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps Unknown/Masteriyo LMS (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for Unknown/Masteriyo LMS.
2. 2Review the reported fix. Update Unknown/Masteriyo LMS to 3.4.0 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

1. Published upstream

   Sep 9, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Sep 9, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Sep 9, 2026

Sources and claim methodology

• Source referencewpscan.com

Related CVEs

• Eventin <= 4.1.17 - Missing Authorization to Authenticated (Subscriber+) Notification Flow Management via notification-flow REST API EndpointAlso CWE-862
• WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking CancellationAlso CWE-862
• Checkout Custom Fields Builder for WooCommerce <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation via 'plugin' ParameterAlso CWE-862
• Awesome Support <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Denial via 'user_id' ParameterAlso CWE-862
• Ultimate Gift Cards for WooCommerce < 3.2.10 - Subscriber+ Gift Card Theft and Destruction via Unauthorized RedemptionAlso CWE-862
• WP Recipe Maker <= 10.8.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Recipe Ownership Takeover and Unpublishing via '[wprm-recipe]' ShortcodeAlso CWE-862