The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessions, allowing unauthenticated attackers to terminate the active sessions (force-logout) of any user on the site, including administrators.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
References
History
Mon, 27 Jul 2026 06:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessions, allowing unauthenticated attackers to terminate the active sessions (force-logout) of any user on the site, including administrators. | |
| Title | Masteriyo LMS < 2.3.1 - Unauthenticated Arbitrary User Session Termination (Denial of Service) | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: WPScan
Published:
Updated: 2026-07-27T06:00:02.553Z
Reserved: 2026-06-25T13:35:35.434Z
Link: CVE-2026-13332
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.