The Masteriyo LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.1.6. This is due to the plugin allowing a u…

The Masteriyo LMS plugin for WordPress contains a privilege escalation vulnerability in versions up to 2.1.6. The vulnerability exists in the InstructorsController::prepare_object_for_database function which allows users to update their user role. Authenticated attackers with Student-level access or higher can exploit this flaw to elevate their privileges to administrator level. This represents a significant security risk as it allows low-privileged users to gain full administrative control over WordPress installations using the affected plugin.