cbcvebase.
CVE-2024-33939
published 2025-05-19

CVE-2024-33939: Authentication Bypass Using an Alternate Path or Channel vulnerability in masteriyo Masteriyo - LMS learning-management-system.This issue affects Masteriyo -…

PriorityP180medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
0.84%
53.3th percentile
Authentication Bypass Using an Alternate Path or Channel vulnerability in masteriyo Masteriyo - LMS learning-management-system.This issue affects Masteriyo - LMS: from n/a through <= 1.7.3.

Affected

2 ranges
VendorProductVersion rangeFixed in
masteriyomasteriyo_lms<= 1.7.3
themegrillmasteriyo< 1.7.41.7.4

Detection & IOCsextracted from sources · hover to see the quote

url/wp-json/masteriyo/v1/course-progress?user_id={{user}}
path/wp-content/plugins/learning-management-system/
  • Unauthenticated GET requests to /wp-json/masteriyo/v1/course-progress with a user_id parameter returning HTTP 200 with JSON body containing 'course_id', 'course_permalink', and 'status' fields indicate successful IDOR exploitation.
  • Monitor for unauthenticated requests to the Masteriyo REST API endpoint iterating over numeric user_id values (1–10+) in a clusterbomb/enumeration pattern.
  • Presence of the plugin path /wp-content/plugins/learning-management-system/ in HTTP responses can be used to fingerprint vulnerable Masteriyo LMS installations for targeting.
  • ·The vulnerability affects Masteriyo LMS versions n/a through 1.7.3 only; versions above 1.7.3 are not affected.
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.