Unauthenticated Session Termination in Masteriyo LMS Plugin

The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessions, allowing unauthenticated attackers to terminate the active sessions (force-logout) of any user on the site, including administrators.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Masteriyo LMS, a popular WordPress learning management system plugin, contains a critical authorization bypass vulnerability in its AJAX session-clearing functionality. The plugin fails to verify user authentication before processing requests to terminate active sessions, allowing any unauthenticated attacker to force-logout legitimate users—including site administrators. With a CVSS score of 9.1, this vulnerability poses severe risks to organizations relying on Masteriyo for course delivery and user management. Affected sites running versions before 2.3.1 face immediate threats of service disruption, account takeover cascades, and potential operational chaos as attackers systematically log out users to disrupt learning activities or facilitate lateral attacks.

Casky's 283 mapped security skills leverage Claude AI with extended reasoning to identify the attack patterns underlying this vulnerability across MITRE ATT&CK's Initial Access (TA0004) and Credential Access (TA0006) tactics. Practitioners monitoring their Casky findings would detect suspicious patterns including: repeated unauthenticated AJAX calls to session-clearing endpoints, mass session termination events without corresponding user actions, and authorization check bypasses in request handling chains. The platform's skill coverage specifically highlights CWE-287 (Improper Authentication) violations, flagging instances where authentication validation is missing or occurs after authorization decisions. Security teams would observe these attack indicators in their AJAX traffic analysis and application logs, enabling them to patch Masteriyo before attackers exploit the vulnerability at scale.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-13332.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-13332

Casky has 283 skills that investigate the attack patterns behind CVE-2026-13332. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn