by Kastro
Paper/Archive/CVE-2026-13332

CVE-2026-13332

Unknown Masteriyo LMS — Masteriyo LMS < 2.3.1 - Unauthenticated Arbitrary User Session Termination (Denial of Service)

EPSS 0.4%public exploitCVSS 9.1
critical.is priorityof 100
45
CVSS 9.1 (ADP)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 36.1.361 × 207.2Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessions, allowing unauthenticated attackers to terminate the active sessions (force-logout) of any user on the site, including administrators.

Affected

ProductAffectedFixed inSource
Masteriyo LMS< 2.3.12.3.1CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitwpscan.com/vulnerability/f987c823-f215-48f6-86fe-8d898f2c2d94