SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-13332

CRITICAL · CVSS 9.1 EPSS 0.24%

Source: NVD + CISA KEV + EPSS · Published 2026-07-27 · Last synced 2026-08-26

CyberRota Analysis

AI-Generated

The Masteriyo LMS plugin for WordPress prior to version 2.3.1 is vulnerable due to improper authorization checks on an unauthenticated AJAX action, enabling attackers to forcefully log out any user, including administrators. This critical flaw poses a significant risk to site security and user session integrity. WordPress site administrators using this plugin should prioritize immediate updates to mitigate potential exploitation.

CVE
CVE-2026-13332
Severity
CRITICAL
CVSS
9.1
EPSS
0.24%
WordPress

Original NVD Description

The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessions, allowing unauthenticated attackers to terminate the active sessions (force-logout) of any user on the site, including administrators.