Description
The Masteriyo LMS WordPress plugin before 3.4.1 does not verify ownership of, or restrict the type of, the records a user requests for download, allowing users with the instructor role to retrieve the full content and metadata of arbitrary posts, including other instructors' private and draft courses.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Masteriyo LMS | 1.14.0 – < 3.4.1 | 3.4.1 |
References
- https://wpscan.com/vulnerability/07664081-72c3-4f7e-9324-e0047b6e6d22/ exploit vdb-entry technical-description