CVE-2026-8279

5.3 Moyenne

Publiée le 07/09/2026 à 15:20 · Modifiée le 08/09/2026 à 17:18 · Analyse NVD reportée · Source : security@wordfence.com

Description

The Masteriyo LMS plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the 'delete_item_permissions_check' function in the CourseProgressItemsController in all versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to delete arbitrary course progress records belonging to any student.

Traduire en français

Produits concernés

Masteriyo LMS – LMS Course Builder, Quizzes & Certificates

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.3 Moyenne	security@wordfence.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N`

Faiblesses (CWE)

CWE-862

Références

https://plugins.trac.wordpress.org/browser/learning-management-system/tags/2.1.9/includes/Repository/CourseProgressItemRepository.php#L269
https://plugins.trac.wordpress.org/browser/learning-management-system/tags/2.1.9/includes/RestApi/Controllers/Version1/CourseProgressItemsController.php#L124
https://plugins.trac.wordpress.org/browser/learning-management-system/tags/2.1.9/includes/RestApi/Controllers/Version1/CourseProgressItemsController.php#L805
https://www.wordfence.com/threat-intel/vulnerabilities/id/d317d40b-2b99-408b-b445-1a789df3c958?source=cve

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories