PatchSiren cyber security CVE debrief
CVE-2026-39524 ThemeGrill CVE debrief
CVE-2026-39524 is a HIGH severity vulnerability (CVSS Score: 7.5) in the Masteriyo - LMS plugin up to version 2.1.5. The vulnerability is caused by unauthenticated broken access control, which could allow attackers to bypass payment controls. The vulnerability was published on [cvePublishedAt] and last modified on [cveModifiedAt].
- Vendor
- ThemeGrill
- Product
- Masteriyo - LMS
- CVSS
- HIGH 7.5
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-15
- Original CVE updated
- 2026-06-15
- Advisory published
- 2026-06-15
- Advisory updated
- 2026-06-15
Who should care
Users of Masteriyo - LMS plugin versions up to 2.1.5 should apply patches or mitigations to prevent potential attacks.
Technical summary
The vulnerability has a CVSS vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N and is classified under CWE-862. It was reported by [email protected].
Defensive priority
HIGH
Recommended defensive actions
- Apply patches or updates to Masteriyo - LMS plugin to version 2.1.6 or later.
- Restrict access to sensitive areas of the plugin.
- Monitor plugin usage for suspicious activity.
Evidence notes
Evidence suggests that the vulnerability was reported by Patchstack (see [ref-4]).
Official resources
-
CVE-2026-39524 CVE record
CVE.org
-
CVE-2026-39524 NVD detail
NVD
-
Source item URL
nvd_modified
- Mitigation or vendor reference
CVE-2026-39524 was published on June 15, 2026, and last modified on June 15, 2026.