Critical severity · published Jul 27, 2026
CVE-2026-13332
Masteriyo LMS < 2.3.1 - Unauthenticated Arbitrary User Session Termination (Denial of Service)
9.1
CVSS
0.4%
EPSS
No
On KEV
Description
The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessions, allowing unauthenticated attackers to terminate the active sessions (force-logout) of any user on the site, including administrators.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ML
Masteriyo LMS ·
before 2.3.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-13332
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-13332
wpscan.com
https://wpscan.com/vulnerability/f987c823-f215-48f6-86fe-8d898f2c2d94/
More from Masteriyo LMS
9.9
CVE-2026-82845
Masteriyo LMS < 3.4.1 - Subscriber+ PHP Object Injection
6.8
CVE-2026-82847
Masteriyo LMS < 3.4.1 - Instructor+ Stored XSS via Course Highlights
6.8
CVE-2026-82846
Masteriyo LMS 1.18.0 - 2.3.3 - Instructor+ Stored XSS via Course Custom Fields
6.5
CVE-2026-10824
Masteriyo LMS < 2.2.1 - Unauthenticated Course Progress Disclosure and Deletion
6.1
CVE-2026-19712
Masteriyo LMS < 2.3.3 - Instructor+ Stored XSS via Quiz Description