CVE-2026-8279: 
WordPress vulnerability analysis and mitigation

CVE-2026-8279 is a Missing Authorization vulnerability in the Masteriyo LMS – LMS Course Builder, Quizzes & Certificates plugin for WordPress. It affects all versions up to and including 2.2.0, allowing unauthenticated attackers to delete arbitrary course progress records belonging to any student. The vulnerability was published on September 7, 2026, and assigned a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Wordfence).

The root cause is a missing capability check (CWE-862: Missing Authorization) on the delete_item_permissions_check function within the CourseProgressItemsController REST API controller. Because no authentication or privilege verification is enforced before processing delete requests, any unauthenticated network attacker can send a crafted HTTP DELETE request to the course progress items REST API endpoint and trigger deletion of arbitrary student progress records. The vulnerable code paths are documented in the plugin's CourseProgressItemsController.php (lines 124 and 805) and CourseProgressItemRepository.php (line 269) (GitHub Advisory, Wordfence).

Successful exploitation allows an unauthenticated attacker to permanently delete course progress records for any student enrolled in any course managed by the Masteriyo LMS plugin. This results in an integrity impact — irreversible loss of student progress tracking data — which could disrupt e-learning operations, invalidate completion records, and undermine trust in the platform. There is no confidentiality or availability impact, and no evidence of lateral movement potential beyond data destruction (GitHub Advisory, Wordfence).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation at this time. The vulnerability is automatable (no user interaction or authentication required), making it straightforward to exploit at scale if targeted. The EPSS score is approximately 0.235%, indicating a low near-term exploitation probability. The CVE status is listed as "Deferred" and it is not currently listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory, Wordfence).

1. Reconnaissance: Identify WordPress sites running the Masteriyo LMS plugin version ≤ 2.2.0 using tools like WPScan, Shodan, or by checking the plugin's readme.txt file at https://target.com/wp-content/plugins/learning-management-system/readme.txt.
2. Enumerate course progress item IDs: Query the Masteriyo REST API (e.g., GET /wp-json/masteriyo/v1/course-progress-items) to enumerate existing course progress item IDs, which may be accessible without authentication depending on configuration.
3. Craft DELETE request: Send an unauthenticated HTTP DELETE request to the course progress items endpoint, targeting a specific progress item ID: DELETE /wp-json/masteriyo/v1/course-progress-items/{id}.
4. Achieve unauthorized deletion: Because delete_item_permissions_check performs no capability verification, the server processes the request and permanently deletes the targeted student progress record without requiring any credentials (GitHub Advisory, Wordfence).

• Network: Unusual unauthenticated HTTP DELETE requests to /wp-json/masteriyo/v1/course-progress-items/{id} from external IP addresses; high volume of DELETE requests to this endpoint in a short timeframe.
• Logs: WordPress access logs showing repeated DELETE requests to the Masteriyo REST API endpoint without associated authentication tokens or session cookies; HTTP 200 responses to unauthenticated DELETE requests on this endpoint.
• Application: Unexpected mass deletion or disappearance of student course progress records in the Masteriyo LMS database; missing entries in the course progress items table without corresponding administrative action.

Site administrators should update the Masteriyo LMS plugin to a version newer than 2.2.0, which addresses the missing capability check on the delete_item_permissions_check function. As an interim workaround, consider restricting access to the WordPress REST API for unauthenticated users using a security plugin or server-level rules, or disabling the Masteriyo REST API endpoints until the patch is applied. Implementing audit logging for deletion operations on course progress records is also recommended to detect any prior exploitation (GitHub Advisory, Wordfence).