Security notice
WordPress site using Masteriyo LMS? A flaw rated 9.8 can let anyone upload files and take over the site. Update to 2.3.3 or later.
Masteriyo LMS (also listed as Masteriyo - LMS by ThemeGrill) is a WordPress learning plugin. Patchstack published CVE-2026-73996, an unauthenticated arbitrary file upload flaw rated CVSS 9.8, affecting versions up to and including 2.3.2. Attackers with no login can upload files that let them take over the site. The fixed version is 2.3.3. WordPress.org shows 6,000+ active installations. Update today, or deactivate the plugin until you can, then check for unfamiliar admins, plugins and PHP files. (Patchstack, WordPress.org plugin page)
What happened
- The flaw. CVE-2026-73996 is an unrestricted file upload with a dangerous type in ThemeGrill's Masteriyo - LMS plugin (WordPress slug
learning-management-system). Versions up to and including 2.3.2 are affected. Version 2.3.3 and later are fixed. Patchstack rates it CVSS 9.8 and high priority. (Patchstack, CVE-2026-73996) - What that means. Someone who is not logged in can upload a malicious file and use it to take control of the WordPress site. We are not publishing technical details. (Patchstack)
- Risk language. Patchstack says the flaw is highly dangerous and expected to become exploited in mass campaigns. That is a risk warning, not a confirmed count of hacked sites. (Patchstack)
- What we could not confirm. Flare's brief said CISA added CVE-2026-73996 to KEV on November 5, 2026. When we checked CISA's KEV catalog JSON on November 6, 2026, that CVE ID was not listed. We do not claim CISA KEV status on this page.
Who should worry
Anyone whose WordPress site runs the Masteriyo LMS plugin at 2.3.2 or earlier.
- You sell or host courses with Masteriyo on WordPress.
- An agency built your training or membership site on Masteriyo and has not updated it.
If the plugin is not installed, or you are already on 2.3.3 or later (WordPress.org currently shows 3.5.1 as current), this specific CVE does not apply. Stay updated anyway.
What to do now
- Update Masteriyo LMS to 2.3.3 or later today. Prefer the latest version shown on WordPress.org. (Patchstack, WordPress.org plugin page)
- If you cannot update, deactivate the plugin until you can. A deactivated vulnerable plugin is safer than an active one facing the open internet.
- Check for a break-in. Look for unfamiliar administrator users, plugins you did not install, and unexpected PHP files in uploads or plugin folders. If anything looks wrong, have a professional clean and harden the site; do not assume a plugin update alone removes an attacker who is already in.
What to send your developer, agency or host
Please update Masteriyo LMS (WordPress plugin slug learning-management-system, ThemeGrill) on every site that runs it. CVE-2026-73996 is an unauthenticated arbitrary file upload in versions 2.3.2 and earlier, CVSS 9.8 per Patchstack, fixed in 2.3.3+. If you cannot update immediately, deactivate the plugin. After updating, check for unfamiliar admins, plugins and PHP files. Please confirm the version you left us on. Sources: Patchstack, CVE-2026-73996.
Common questions
Has my site been hacked?
This notice does not mean your site has been hacked. It means a critical upload flaw exists in older Masteriyo versions and you should update and look for odd admin users or files.
Can EverThread tell me if I am affected?
No. EverThread does not test for this. We cannot see which WordPress plugins your site runs or which versions they are on. A scan without a warning about this plugin does not mean your site is safe.
Is 2.3.3 enough, or do I need the latest?
Patchstack and the CVE record mark 2.3.3 as the fixed version for this flaw. Running the latest WordPress.org release is still the better habit so you pick up later fixes too. (Patchstack, WordPress.org plugin page)
Where can I follow updates?
Follow Patchstack, CVE-2026-73996 and the Masteriyo changelog. All current notices are on our notices page.
Security alerts by email
Hear about the next one first.
When a flaw puts websites at risk, we send one email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.
Sources
- Patchstack: Masteriyo - LMS <= 2.3.2 arbitrary file upload, CVSS 9.8, patched in 2.3.3, published August 18, 2026, checked November 6, 2026.
- CVE Program: CVE-2026-73996 (Patchstack), ThemeGrill Masteriyo - LMS, checked November 6, 2026.
- WordPress.org plugin page: active installations 6,000+; current version 3.5.1 when checked November 6, 2026.
- Masteriyo changelog: project changelog, checked November 6, 2026.
- CISA KEV catalog JSON, checked November 6, 2026: CVE-2026-73996 not present in that snapshot.