CVE-2026-4484

The Masteriyo LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.1.6. This is due to the plugin allowing a user to update the user role through the 'InstructorsController::prepare_object_for_database' function. This makes it possible for authenticated attackers, with Student-level access and above, to elevate their privileges to that of an administrator.

• CWE-862

• https://plugins.trac.wordpress.org/browser/learning-management-system/tags/2.1.6/includes/RestApi/Controllers/Version1/InstructorsController.php#L305
• https://plugins.trac.wordpress.org/changeset/3490792/learning-management-system/trunk/includes/RestApi/Controllers/Version1/InstructorsController.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/265be0af-66a4-4636-ab81-f8e2c5a1282e?source=cve

Published

Mar 26, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44832Snipe-IT is an IT asset/license management system. Prior to …8.8
• CVE-2026-44833Snipe-IT is an IT asset/license management system. Prior to …7.1
• CVE-2026-44836view_component is a framework for building reusable, testabl…6.5
• CVE-2026-44837view_component is a framework for building reusable, testabl…7.5
• CVE-2026-44838RabbitMQ is a messaging and streaming broker. From 4.2.0 to …8.1
• CVE-2026-44839RabbitMQ is a messaging and streaming broker. From 3.7.0 to …4.8
• CVE-2026-44840Dgraph is an open source distributed GraphQL database. Prior…7.5
• CVE-2026-44843LangChain is a framework for building agents and LLM-powered…8.2
• CVE-2026-44844eml_parser serves as a python module for parsing eml files a…6.3
• CVE-2026-44847MaxKB is an open-source AI assistant for enterprise. Prior t…7.5
• CVE-2026-44848Portainer Community Edition is a lightweight service deliver…8.8
• CVE-2026-44849Portainer Community Edition is a lightweight service deliver…8.8