CVE-2026-82851CWE-639

CVE-2026-82851

Low · published September 12, 2026

CVSS v3.1
2.7
EPSS
0%
Percentile
21.4
In the wild
Unconfirmed
What it is

The Masteriyo LMS WordPress plugin before 3.4.1 does not verify ownership of, or restrict the type of, the records a user requests for download, allowing users with the instructor role to retrieve the full content and metadata of arbitrary posts, including other instructors' private and draft courses.

The record
Technical detail
CVSS v3.1
2.7 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00299 · 21.4th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-12T10:16Z
References (1)
https://wpscan.com/vulnerability/07664081-72c3-4f7e-9324-e0047b6e6d22/ · [email protected]
EPSS history
Timeline
  • 13 SEP 03:23Z
    EPSS moved — → 0%
    epss
  • 12 SEP 06:00Z
    Masteriyo LMS 1.14.0 - 3.4.0 - Instructor+ Arbitrary Post Disclosure via IDOR
    cvelistv5