Unrated severityNVD Advisory· Published Jul 27, 2026· Updated Jul 27, 2026
Masteriyo LMS < 2.3.1 - Unauthenticated Arbitrary User Session Termination (Denial of Service)
CVE-2026-13332
Description
The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessions, allowing unauthenticated attackers to terminate the active sessions (force-logout) of any user on the site, including administrators.
Affected products
1- Range: <2.3.1
Patches
Vulnerability mechanics
References
1- wpscan.com/vulnerability/f987c823-f215-48f6-86fe-8d898f2c2d94/mitreexploitvdb-entrytechnical-description
News mentions
0No linked articles in our index yet.