low2.7
CVE-2026-82851
The Masteriyo LMS WordPress plugin before 3.4.1 does not verify ownership of, or restrict the type of, the records a user requests for download, allowing users…
Impact
The Masteriyo LMS WordPress plugin before 3.4.1 does not verify ownership of, or restrict the type of, the records a user requests for download, allowing users with the instructor role to retrieve the full content and metadata of arbitrary posts, including other instructors' private and draft courses.
Affected products
| Product | Affected versions |
|---|---|
| Masteriyo LMS WordPress Plugin | before 3.4.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.