Vulnerability Research Plan: CVE-2026-39524 - Masteriyo LMS Missing Authorization

1. Vulnerability Summary

The Masteriyo LMS plugin (up to version 2.1.5) contains a missing authorization vulnerability in its Stripe integration addon. Specifically, the function save_stripe_account() in Masteriyo\Addons\Stripe\StripeAddon is responsible for updating sensitive Stripe settings (including stripe_user_id and sandbox mode).

While the function is hooked to admin_head and performs a nonce check (masteriyo_stripe_nonce), it fails to perform a capability check (e.g., current_user_can('manage_options')). If an attacker can obtain a valid masteriyo_stripe_nonce (which is often leaked in public localized scripts or during unauthenticated interactions) and trick the environment into satisfying the get_current_screen() check, or if the logic is reachable via other means, they can manipulate the plugin's payment configuration.

2. Attack Vector Analysis

• Endpoint: wp-admin/admin.php?page=masteriyo (or any URL that satisfies the toplevel_page_masteriyo screen check).
• Hook: admin_head via StripeAddon::save_stripe_account.
• Vulnerable Parameters: nonce, accountId, mode.
• Authentication: Unauthenticated (if the nonce