CVE-2026-82851
Received Received - Intake

Masteriyo LMS Unauthorized Post Data Exposure

Publication date: 2026-09-12

Last updated on: 2026-09-12

Assigner: WPScan

Description
The Masteriyo LMS WordPress plugin before 3.4.1 does not verify ownership of, or restrict the type of, the records a user requests for download, allowing users with the instructor role to retrieve the full content and metadata of arbitrary posts, including other instructors' private and draft courses.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-12
Last Modified
2026-09-12
Generated
2026-09-12
AI Q&A
2026-09-12
EPSS Evaluated
N/A
NVD
CVE-2026-82851
EUVD
EUVD-2026-76789

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
masteriyo lms From 1.14.0 (inc) to 3.4.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) flaw in the Masteriyo LMS WordPress plugin versions 1.14.0 to 3.4.0. It allows users with the instructor role to access and download the full content and metadata of arbitrary posts, including private and draft courses created by other instructors. The plugin fails to verify ownership or restrict the type of records a user can request.

Detection Guidance

Check the installed version of the Masteriyo LMS plugin. If it is between 1.14.0 and 3.4.0, the system is vulnerable. Use WordPress admin panel or run a command like 'wp plugin list' in the WordPress directory to verify the version.

Impact Analysis

If you are an instructor using the affected Masteriyo LMS plugin versions, an attacker with instructor privileges could access and download your private or draft course content, as well as metadata from other instructors' courses. This could lead to unauthorized data exposure and potential misuse of sensitive information.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by exposing private or sensitive data, such as draft courses or personal information, without proper authorization. Unauthorized access to such data may violate confidentiality requirements and data protection regulations.

Mitigation Strategies

Update the Masteriyo LMS plugin to version 3.4.1 or later immediately. Remove or restrict access for users with the instructor role until the update is applied. Monitor for unauthorized access or data exfiltration.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82851. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart