CVE-2026-49111: WordPress Masteriyo - LMS plugin <= 2.2.0 - Privilege Escalation vulnerability

Synopsis

An incorrect privilege assignment vulnerability in the Masteriyo LMS WordPress plugin (versions up to and including 2.2.0) allows a logged-in user to escalate their own account privileges beyond what should be permitted. The vulnerability is reachable over the network and requires only a low-privilege account, such as a standard student or subscriber account. Successful exploitation gives the attacker full read, write, and availability impact on the affected installation, effectively granting them administrator-level control. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment a fix version is published upstream.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WordPress installation over the network; the vulnerable plugin endpoint is exposed via standard HTTP/HTTPS, meaning any internet-facing or internally reachable WordPress site is in scope.

• AuthenticationRequired

  A low-privilege account is sufficient; any registered user such as a student or subscriber can trigger the privilege escalation without needing admin credentials.

• Victim interactionNot required

  No victim interaction is needed; the attacker submits a crafted request directly and the escalation occurs without requiring another user to click anything or take any action.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental preconditions beyond holding a valid low-privilege account.

Blast Radius

• Reads all site content, user data, private course materials, and stored credentials accessible to a WordPress administrator.
• Modifies or deletes any post, page, user account, or plugin and theme configuration on the site.
• Installs arbitrary plugins or themes, enabling persistent backdoors or further lateral movement within the hosting environment.
• Disrupts site availability by altering critical settings or removing core configuration, taking the LMS offline for legitimate users.