External risk intelligence

Masteriyo LMS Unauthenticated Arbitrary File Upload Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-73996

The vulnerability affects a Learning Management System (LMS) plugin for WordPress. Such plugins are typically deployed to power public-facing websites and course portals, making them directly reachable from the internet as part of the standard web application surface.

Unrestricted File Upload

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical vulnerability in a widely used Learning Management System plugin for WordPress. The issue allows unauthenticated attackers to upload arbitrary files, potentially leading to the compromise of systems hosting educational content and user data. The primary concern at this stage is confirming if this specific plugin is in use and, if so, assessing the exposure.

Unauthenticated file uploads can harm systems.
Important for protecting online education platforms.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can upload arbitrary files to a vulnerable WordPress site running the Masteriyo LMS plugin. This access allows an attacker to upload malicious files, potentially leading to complete system compromise.

No authentication required.
Upload any file type.
Execute arbitrary code.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to upload arbitrary files to the server when supported by the advisory. This could lead to the compromise of the underlying system and sensitive data.

Server files and sensitive information.
Unauthenticated file upload.
System compromise and data exposure.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in the Masteriyo LMS plugin impacts WordPress sites, requiring immediate attention from teams managing web applications and their plugins. The initial step is to inventory all WordPress installations, identify those using the affected plugin, and determine its exposure and business criticality. Once ownership is confirmed, a risk-based remediation plan should be developed, potentially involving coordination with the vendor or implementation of compensating controls.

Ownership: Web application and plugin administrators.
Verify: Plugin usage and internet reachability.
Action: Plan risk-based remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Masteriyo LMS plugin?

Masteriyo is a Learning Management System plugin built for WordPress websites. It provides the framework for administrators to create, manage, and sell online courses, handle student enrollments, and host educational content directly through their existing WordPress dashboard.

What does CWE-434 mean for CVE-2026-73996?

CWE-434 refers to Unrestricted Upload of File with Dangerous Type. In the context of this CVE, it means the software fails to properly check or limit the types of files uploaded to the server. Because the plugin does not validate user-supplied files, an attacker can upload malicious scripts that the server might then execute, granting them significant control over the application.

How does an attacker trigger this file upload vulnerability?

An attacker triggers this flaw by sending a specially crafted request to the web server that includes a malicious file. Because the plugin lacks authentication requirements for this action, the attacker does not need an account or administrative privileges to interact with the upload function. Simply navigating to the plugin's upload endpoint—without needing to log in—is sufficient to execute the attack.

Why does Halo Surface Signal categorize this as an external threat?

Halo Surface Signal flags this as an external threat because Masteriyo is designed to power public-facing course portals. Since these websites are intended to be accessible to students and the public over the internet, the plugin's features are naturally exposed to network-based attackers. This visibility makes it a direct target for anyone browsing the web, rather than an internal-only component.

Do I need to check my WordPress sites for this plugin?

Yes. If you manage WordPress environments, your first step is to perform an inventory of all installed plugins to determine if Masteriyo LMS is active. Once you have identified which sites are using it, assess their role and internet reachability. Prioritize systems that host sensitive user data or critical course infrastructure, and prepare a plan to update the plugin or implement controls to restrict unauthorized access.

References

patchstack.com/database/wordpress/plugin/learning-management-system/…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.