Vulnerability · Published Jul 27, 2026 · Assigned by WPScan
CVE-2026-13332Masteriyo LMS < 2.3.1 - Unauthenticated Arbitrary User Session Termination (Denial of Service)
Critical 9.1
In plain English
A critical-severity improper authentication in Masteriyo LMS from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).
Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)0.4%top 63.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessions, allowing unauthenticated attackers to terminate the active sessions (force-logout) of any user on the site, including administrators.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Masteriyo LMS | 0 – before 2.3.1 |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
References
- https://wpscan.com/vulnerability/f987c823-f215-48f6-86fe-8d898f2c2d94/ exploit, vdb-entry, technical-description