CVE-2026-82849: Masteriyo LMS < 3.4.2 - Subscriber+ Arbitrary User Course Progress Disclosure via IDOR
The Masteriyo LMS WordPress plugin before 3.4.2 does not verify that the user making the request owns the course-progress records being returned, allowing any authenticated user, such as a self-registered subscriber, to read another user's learning activity. The ownership check it applies is skipped whenever the requested account is not named with a non-zero value, in which case the records of every learner on the site are returned at once.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user can exploit it, including a self-registered subscriber. The issue affects sites where such low-privileged accounts can access the vulnerable course-progress request.
What information can an attacker access?
An attacker can read other users' course-progress records, exposing learners' activity. When the requested account is not supplied with a non-zero value, the request returns progress records for every learner on the site.
Which versions are affected?
Masteriyo LMS versions before 3.4.2 are affected.