CVE-2026-5167 | Masteriyo LMS Plugin up to 2.1.7 on WordPress Webhook Endpoint handle_webhook order_id authorization

A vulnerability was found in Masteriyo LMS Plugin up to 2.1.7 on WordPress. It has been rated as critical. Affected by this issue is the function handle_webhook of the component Webhook Endpoint. The manipulation of the argument order_id leads to authorization bypass.

This vulnerability is uniquely identified as CVE-2026-5167. The attack is possible to be carried out remotely. No exploit exists.