CVE-2026-5167 masteriyo CVE debrief

Who should care

Users of Masteriyo LMS – Online Course Builder for eLearning, LMS & Education plugin for WordPress should verify their installation and ensure proper configuration of webhook_secret. Additionally, security teams and operators managing WordPress environments with this plugin should be aware of the potential for unauthorized access to paid course content.

Technical summary

The Masteriyo LMS plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in versions up to and including 2.1.7. This is due to insufficient webhook signature verification in the handle_webhook() function. The webhook endpoint processes unauthenticated requests and only performs signature verification if both the webhook_secret setting is configured AND the HTTP_STRIPE_SIGNATURE header is present. Since webhook_secret defaults to an empty string, the webhook processes attacker-controlled JSON payloads without any verification.

Defensive priority

Medium priority given the CVSS score of 5.3 and the potential for unauthorized access to paid course content.

Recommended defensive actions

• Verify and update Masteriyo LMS plugin to the latest version
• Configure webhook_secret setting properly
• Monitor for suspicious webhook requests
• Restrict access to sensitive course content
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

Evidence from Wordfence security research indicates insufficient webhook signature verification allows unauthenticated attackers to send fake Stripe webhook events. The webhook endpoint processes unauthenticated requests and only performs signature verification if both the webhook_secret setting is configured AND the HTTP_STRIPE_SIGNATURE header is present. Since webhook_secret defaults to an empty string, the webhook processes attacker-controlled JSON payloads without any verification. This makes it possible for unauthenticated attackers to send fake Stripe webhook events with arbitrary order_id values in the metadata, mark any order as completed without payment, and gain unauthorized access to paid course content. Defenders should verify webhook_secret configuration and monitor for suspicious webhook requests.

Official resources