Critical severity9.1NVD Advisory· Published Jul 27, 2026· Updated Jul 27, 2026

CVE-2026-13332

Description

The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessions, allowing unauthenticated attackers to terminate the active sessions (force-logout) of any user on the site, including administrators.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Masteriyo Lmsllm-fuzzy
Range: <2.3.1
Package: https://wordpress.org/plugins/masteriyo-lms

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/f987c823-f215-48f6-86fe-8d898f2c2d94/nvd

News mentions

No linked articles in our index yet.

cvss	0.591
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000