A critical authentication vulnerability in the Masteriyo LMS plugin allows unauthenticated attackers to perform unauthorized session termination across the platform.

The plugin exposes an AJAX action that lacks proper authorization checks. Unauthenticated attackers can leverage this to force the termination of any active user session.

While this vulnerability does not allow for data theft, it enables a high-impact denial of service for legitimate users and administrative staff. With a CVSS score of 9.1, the ability to disrupt business operations and administrative functions poses a significant threat to site availability.

Immediate Action: Update the Masteriyo LMS plugin to version 2.3.1 or higher to apply the necessary authorization checks on the affected AJAX action.

Proactive Monitoring: Monitor server logs for frequent or unexplained session termination events or unauthorized AJAX requests.

Compensating Controls: Utilize a Web Application Firewall (WAF) to restrict access to sensitive AJAX endpoints and prevent unauthorized requests from reaching the plugin.

Public Exploit Available: Unknown.

The risk of forced logout attacks against administrators and users necessitates immediate patching. Organizations should update to the latest version of Masteriyo LMS as soon as possible to ensure session integrity and prevent service disruption.