Security Advisory

CVE-2026-10824

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-06-25 06:00:01

Last updated 2026-06-25 13:05:28

Assigner WPScan

CVSS score not scored

State PUBLISHED

Description

The Masteriyo LMS WordPress plugin before 2.2.1 does not perform authorization checks in a course-progress REST API controller, allowing unauthenticated users to read and permanently delete any user's course-progress records.

← Browse all CVEs View on cve.org ↗