The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessions, allowing…

A vulnerability in the Masteriyo LMS WordPress plugin before version 2.3.1 allows unauthenticated attackers to force-logout any user on the site, including administrators. The flaw exists in an unauthenticated AJAX action used to clear user sessions, where authorization is not correctly verified. No authentication is required to exploit this vulnerability. Attackers can terminate active sessions for any account, potentially disrupting site administration and user access. This represents a significant authorization bypass issue affecting WordPress sites running the affected plugin versions.