Vulnerability · Published Sep 24, 2026 · Assigned by WPScan

CVE-2026-82850Masteriyo LMS < 3.4.2 - Subscriber+ Quiz Answer Key Disclosure

Medium 4.3

In plain English

A medium-severity information exposure in Masteriyo LMS from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 93.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Masteriyo LMS WordPress plugin before 3.4.2 does not restrict access to quiz answer keys, allowing any authenticated user, such as a student, to retrieve the correct answers for any quiz on the site, including quizzes in courses they are not enrolled in. The redaction that hides them is applied only to a fixed list of question types, so the answers to every other type are returned in full to anyone able to view the questions.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Masteriyo LMS	0 – before 3.4.2

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://wpscan.com/vulnerability/b26150aa-9220-4eb3-a160-0f5301faacc7/ exploit, vdb-entry, technical-description