External risk intelligence

Masteriyo LMS WordPress Plugin Session Termination Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-13332

The vulnerability exists in a WordPress plugin. WordPress sites are frequently deployed as public-facing web applications, and the vulnerable AJAX action is reachable over the internet as part of the standard website frontend, making it a likely target for external access.

Authentication Bypass

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in the Masteriyo LMS WordPress plugin that allows unauthenticated attackers to log out any user, including administrators. This issue arises from improper authorization checks on an AJAX action that clears user sessions. The primary concern is to confirm if this specific plugin is in use and understand the potential exposure.

Attackers can force any user offline.
Administrators could be locked out of their own sites.
Confirm if the affected plugin is deployed.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can leverage a flaw in an AJAX action within the Masteriyo LMS WordPress plugin to force users, including administrators, to log out. This is possible because the action does not properly check if the user making the request is authorized. By triggering this action, an attacker can effectively disrupt legitimate user access to the site.

No user authentication required.
Unprotected AJAX action triggers logout.
Disrupts user access to the site.

Live Threat

Current exploitation, exposure, and threat context

Unauthenticated attackers could potentially terminate the active sessions of any user on a WordPress site. This could include administrators, potentially disrupting their access and the site's operations when the Masteriyo LMS plugin is in use.

User sessions could be terminated.
Via an unauthenticated AJAX action.
Site administrators could be logged out.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given this vulnerability in a WordPress plugin, the website owner or application owner is primarily responsible for remediation. The first practical step is to identify all WordPress instances, confirm if they host the affected plugin, and assess the business criticality and exposure of those sites. Following this assessment, a plan for remediation or mitigation should be developed in coordination with relevant teams.

Website owners should own the issue.
Verify plugin presence and reachability first.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Masteriyo LMS WordPress plugin?

Masteriyo LMS is a software extension used to transform a WordPress site into an online learning management system. It enables site owners to create, manage, and sell educational courses. By adding this plugin, WordPress administrators can host complex course structures, manage student enrollments, and track user progress, making it a central component for delivering training or curriculum through the website.

How does the CVE-2026-13332 vulnerability work?

This flaw is classified under CWE-287, which refers to improper authentication. Specifically, the plugin fails to verify if a user has permission before executing a command that clears active login sessions. Because the software does not check the identity or authority of the person making the request, an external actor can send a signal that forces the system to drop the connection for any logged-in user.

Can any user trigger this session termination?

Yes, the vulnerability allows unauthenticated attackers to trigger the action. It does not require an account or specific system privileges to initiate the session-clearing command. Note that the bug is tied to a specific AJAX action; normal navigation or standard site usage that does not interact with this specific backend session-clearing function will not inadvertently trigger the logout behavior.

Do I need to worry if my site is not public?

Halo Surface Signal indicates that because this plugin is designed for WordPress, it is frequently deployed on public-facing web applications. Since the vulnerable AJAX action is reachable over the internet as part of the standard website frontend, it is considered a likely target. If your WordPress instance is accessible from the internet, you should treat this as a relevant risk regardless of how small the site is.

What is the first step to address this issue?

Start by auditing your WordPress environments to confirm whether the Masteriyo LMS plugin is currently active. If you find the plugin, identify which versions are running. Since the flaw affects versions before 2.3.1, your priority is to document where the software is deployed and assess the operational impact of potential session disruptions, then coordinate with your technical team to apply the necessary plugin update.

References

wpscan.com/vulnerability/f987c823-f215-48f6-86fe-8d898f2c2d94/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.