Security Alert Summary
The Masteriyo LMS WordPress plugin before 3.4.2 does not sufficiently restrict access to quiz answer keys. Any authenticated user, including students, can retrieve correct answers for quizzes site-wide, including quizzes in courses they are not enrolled in. A redaction intended to hide answers is applied only to a fixed list of question types, so answers for other question types may be returned in full to users who can view the questions.
CVE Details
- CVE ID: CVE-2026-82850
- Affected component: Masteriyo LMS (WordPress plugin)
- Affected versions: Versions earlier than 3.4.2 (any version < 3.4.2)
- Published: September 24, 2026 at 6:17 AM
- Last modified: September 24, 2026 at 2:42 PM
- CVSS v3.1: Base score 4.3, Severity MEDIUM. Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Authentication / privileges / user interaction:
- Authentication: required (any authenticated user)
- Privileges required: LOW
- User interaction: NONE
- Primary impact:
- Confidentiality: LOW (exposure of quiz answer data)
- Integrity: NONE
- Availability: NONE
- CWE / weakness: CWE-200 (Information Exposure)
Technical Details
This vulnerability exists because the plugin does not consistently redact or restrict quiz answer keys for all question types. The redaction mechanism is applied only to a fixed list of question types; for other types the correct answers are returned in full to any authenticated user who can view the questions. As a result, a user with a low-privilege authenticated account (for example, a student account) can retrieve correct answers for quizzes across the site, including for courses they are not enrolled in.
The report does not name specific functions, REST API endpoints, or code paths; it describes the root cause as incomplete redaction and access restriction logic for quiz answer keys. The impact is limited to disclosure of quiz answers and does not indicate modification of content or degradation of availability.
How This Could Impact Your Website
On a typical LMS-powered site, there may be multiple user roles: the site owner or administrator, internal staff such as instructors or course managers, and external users such as students or contractors. In this scenario, a student account could access answer keys for quizzes outside their enrolled courses. Practical consequences may include:
- Disclosure of correct quiz answers to unauthorized users, undermining the integrity of assessments.
- Increased risk of targeted phishing or social engineering if answers reveal course structure or user interaction patterns.
- Potential exposure of sensitive course information or participation details depending on how quiz content is stored or presented.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and permissions, especially contributor- and student-level capabilities that can view quiz content.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and themes to reduce overall exposure.
- Monitor site activity and logs for unusual behavior related to quiz access or unexpected data disclosures.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
