CVE-2026-10824: Unknown Masteriyo Lms

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

The Masteriyo LMS WordPress plugin before 2.2.1 does not perform authorization checks in a course-progress REST API controller, allowing unauthenticated users to read and permanently delete any user's course-progress records.

Affected products

• Unknown Masteriyo Lms: before 2.2.1 (fixed in 2.2.1)

Published 2026-06-25. Last modified 2026-06-25.