CVE-2026-39524: WordPress Masteriyo - LMS plugin <= 2.1.5 - Payment Bypass vulnerability

Synopsis

This is a broken access control vulnerability (a type of authorization bypass) in the Masteriyo LMS plugin for WordPress, affecting versions 2.1.5 and earlier. The vulnerability is reachable over the network and requires no authentication or user interaction, meaning any remote visitor can trigger it without holding an account. Successful exploitation allows an attacker to bypass payment controls, potentially enrolling in paid courses or accessing paid content without completing a legitimate transaction. No fix version has been published yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WordPress site over the network; the vulnerable plugin endpoint is exposed via standard HTTP/HTTPS.

• AuthenticationNot required

  No account or session token of any kind is needed; the access control bypass is reachable by any anonymous HTTP request.

• Victim interactionNot required

  No user action, click, or social engineering is required to trigger the vulnerability.

• Attack complexityDetail

  Exploit complexity is low: no race conditions, memory layout knowledge, or special environmental conditions are needed for a reliable attack.

Blast Radius

• Attacker bypasses payment enforcement and gains enrollment access to one or more paid courses without completing a purchase.
• Paid course content (lessons, quizzes, downloads) becomes readable by unauthorized users, defeating monetization controls.
• Order or enrollment records in the WordPress database may be written or modified to reflect a falsely completed payment state.