Is CVE-2026-5167 actively exploited?

No active exploitation of CVE-2026-5167 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-5167 be exploited remotely?

Yes. CVE-2026-5167 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-5167?

CVE-2026-5167 has a CVSS score of 5.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-5167

MEDIUM

CVE-2026-5167

CWE-639Published: April 8, 2026· Updated: Apr 8, 2026

5.3

CVSS v3.1

EPSS:0.06%probability of exploitation in 30 daysPercentile:18.7th

Official Description

The Masteriyo LMS – Online Course Builder for eLearning, LMS & Education plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in versions up to and including 2.1.7. This is due to insufficient webhook signature verification in the handle_webhook() function. The webhook endpoint processes unauthenticated requests and only performs signature verification if both the webhook_secret setting is configured AND the HTTP_STRIPE_SIGNATURE header is present. Since webhook_secret defaults to an empty string, the webhook processes attacker-controlled JSON payloads without any verification. This makes it possible for unauthenticated attackers to send fake Stripe webhook events with arbitrary order_id values in the metadata, mark any order as completed without payment, and gain unauthorized access to paid course content.

NVD Source

Technical Analysis

CVE-2026-5167 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.