CVE-2026-13332 PUBLISHED

Masteriyo LMS < 2.3.1 - Unauthenticated Arbitrary User Session Termination (Denial of Service)

Assigner: WPScan
Reserved: 25.06.2026 Published: 27.07.2026 Updated: 27.07.2026

The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessions, allowing unauthenticated attackers to terminate the active sessions (force-logout) of any user on the site, including administrators.

Product Status

Vendor Unknown
Product Masteriyo LMS
Versions Default: unaffected
  • affected from 0 to 2.3.1 (excl.)

Credits

  • Nakata Christian finder
  • WPScan coordinator

References

Problem Types

  • CWE-287 Improper Authentication CWE