Executive Summary
A critical vulnerability (CVE-2026-13332) has been disclosed in the Masteriyo LMS WordPress plugin, a popular learning management system with tens of thousands of active installations. The flaw allows unauthenticated attackers to force-logout any user on the site — including site administrators — by exploiting an improperly secured AJAX action.
CVSS Score: 9.1 (Critical)
The vulnerability exists in an unauthenticated AJAX endpoint used to clear user sessions. Due to missing authorization checks, any visitor can invoke this action and terminate active sessions for any account by user ID — no credentials, tokens, or prior access required.
A patch is available in version 2.3.1.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-13332 |
| CVSS Score | 9.1 (Critical) |
| Type | Missing Authorization / Unauthenticated Session Termination |
| Attack Vector | Network (unauthenticated) |
| Privileges Required | None |
| User Interaction | None |
| Affected Plugin | Masteriyo LMS |
| Affected Versions | < 2.3.1 |
| Fixed Version | 2.3.1 |
Affected Versions
| Plugin | Affected Versions | Fixed Version |
|---|---|---|
| Masteriyo LMS | < 2.3.1 | 2.3.1 |
Technical Details
The Masteriyo LMS plugin exposes an AJAX action intended to clear user session data. The action fails to perform any authorization verification before executing, meaning it is callable by any unauthenticated HTTP request. By enumerating or targeting a known user ID (including administrator accounts, which commonly have low IDs like 1), an attacker can repeatedly force-logout all active sessions on the site.
Attack Scenario
1. Attacker identifies a WordPress site running Masteriyo LMS < 2.3.1
2. Attacker sends unauthenticated POST request to wp-admin/admin-ajax.php
with the vulnerable action parameter and a target user ID
3. Plugin executes session clear without checking caller's identity
4. Target user session is terminated — user is logged out immediately
5. Attack can be looped to continuously disrupt admin access to the siteReal-World Impact
While session termination does not directly grant access to site data, the practical impact is significant:
| Impact | Description |
|---|---|
| Administrative Lockout | Admins are repeatedly forced out, blocking site management |
| Denial of Service | Continuous session clearing disrupts all authenticated users |
| Student/Course Disruption | LMS users lose active progress and session state |
| Cover for Other Attacks | Distraction technique during a concurrent attack chain |
| Reputational Damage | Repeated logouts degrade trust in the LMS platform |
Remediation
Step 1: Update to Version 2.3.1
# Via WP-CLI
wp plugin update masteriyo
# Verify installed version
wp plugin get masteriyo --field=versionOr update via WordPress admin: Plugins > Installed Plugins > Masteriyo LMS > Update Now.
Step 2: Audit Active Sessions After Patching
# Check for any suspicious session activity in logs
grep "admin-ajax.php" /var/log/nginx/access.log | grep -i "POST" | tail -100
# Review WordPress user sessions
wp user session list --user=1Step 3: If Immediate Patching Is Not Possible
- Deactivate the Masteriyo LMS plugin until the update can be applied
- Block access to
wp-admin/admin-ajax.phpat the WAF/firewall level for unauthenticated requests targeting the vulnerable action - Monitor access logs for repeated POST requests to admin-ajax.php from unusual IPs
Detection Indicators
| Indicator | Description |
|---|---|
| Repeated unauthenticated POST to admin-ajax.php | Exploitation attempts targeting session clear action |
| Sudden admin session terminations | Active exploitation forcing admin logouts |
| Unusual login/logout frequency in WordPress logs | Repeated forced session cycling |
| High volume requests from single IP to admin-ajax | Automated attack loop |
Post-Remediation Checklist
- Confirm Masteriyo LMS updated to 2.3.1 or later
- Review access logs for signs of prior exploitation
- Check for unauthorized changes made during any admin lockout windows
- Verify all administrator accounts are intact and credentials unchanged
- Deploy a WAF rule to limit unauthenticated AJAX action abuse