https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 18:57:55 +0000 https://cve.radiocsirt.org/vuln/cve-2024-10008 <p><strong>Affected:</strong> Masteriyo LMS – Online Course Builder for eLearning, LMS &amp; Education, masteriyo</p> <p>The Masteriyo LMS – eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to unauthorized user profile modification due to missing authorization checks on the /wp-json/masteriyo/v1/users/$id REST API endpoint in all versions up to, and including, 1.13.3. This makes it possible for authenticated attackers, with student-level access and above, to modify the roles of arbitrary users. As a result, attackers can escalate their privileges to the Administrator and demote existing administrators to students.</p> <p><strong>Affected:</strong> Masteriyo LMS – Online Course Builder for eLearning, LMS &amp; Education, masteriyo</p> <p>The Masteriyo LMS – eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to unauthorized user profile modification due to missing authorization checks on the /wp-json/masteriyo/v1/users/$id REST API endpoint in all versions up to, and including, 1.13.3. This makes it possible for authenticated attackers, with student-level access and above, to modify the roles of arbitrary users. As a result, attackers can escalate their privileges to the Administrator and demote existing administrators to students.</p> https://cve.radiocsirt.org/vuln/cve-2024-10008