CVE-2026-4484

HIGH

Masteriyo LMS <= 2.1.6 - Missing Authorization to Authenticated (Student+) Privilege Escalation to Administrator

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2026-4484. PoCs published by PegasusMetaSec, Nxploited.

AI-analyzed exploit summary The repository contains only a minimal README with no technical details or exploit code. It lacks any meaningful content related to CVE-2026-4484.

Description

The Masteriyo LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.1.6. This is due to the plugin allowing a user to update the user role through the 'InstructorsController::prepare_object_for_database' function. This makes it possible for authenticated attackers, with Student-level access and above, to elevate their privileges to that of an administrator.

Exploits (2)

nomisec STUB 1 stars
by PegasusMetaSec · poc
https://github.com/PegasusMetaSec/PEGASUS-CVE-2026-4484

The repository contains only a minimal README with no technical details or exploit code. It lacks any meaningful content related to CVE-2026-4484.

Classification
Stub 90%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: unknown
No auth needed
devstral-2 · analyzed Apr 21, 2026 Full analysis →
nomisec WORKING POC
by Nxploited · poc
https://github.com/Nxploited/CVE-2026-4484

The repository contains a functional Python exploit for CVE-2026-4484, targeting a WordPress vulnerability. The script includes detailed session handling, nonce extraction, and HTTP request manipulation, indicating a well-developed proof-of-concept.

Classification
Working Poc 90%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: WordPress (specific version not specified)
No auth needed
Prerequisites: Target URL · Network access to the target
devstral-2 · analyzed Apr 18, 2026 Full analysis →

References (3)

Core 3

Scores

CVSS v3 8.8
EPSS 0.0035
EPSS Percentile 27.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-862
Status published
Products (1)
masteriyo/Masteriyo LMS – Online Course Builder for eLearning, LMS & Education < 2.1.6
Published Mar 26, 2026
Tracked Since Mar 26, 2026