CVE-2026-82851 — Masteriyo LMS 1.14.0 - 3.4.0 - Instructor+ Arbitrary Post Disclosure via IDOR

CVE-2026-82851

Masteriyo LMS 1.14.0 - 3.4.0 - Instructor+ Arbitrary Post Disclosure via IDOR PUBLISHED

Description (CNA)

The Masteriyo LMS WordPress plugin before 3.4.1 does not verify ownership of, or restrict the type of, the records a user requests for download, allowing users with the instructor role to retrieve the full content and metadata of arbitrary posts, including other instructors' private and draft courses.

Affected (CNA)

Vendor / product	Versions
Unknown / Masteriyo LMS	affected 1.14.0 before 3.4.1

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/07664081-72c3-4f7e-9324-e0047b6e6d22/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.