Description

The Masteriyo LMS WordPress plugin before 3.4.1 does not verify ownership of, or restrict the type of, the records a user requests for download, allowing users with the instructor role to retrieve the full content and metadata of arbitrary posts, including other instructors' private and draft courses.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.7",
  "pubDate": "2026-09-12T06:16:26.253Z",
  "pubdate": "2026-09-12T06:16:26.253Z",
  "executiveSummary": "The Masteriyo LMS WordPress plugin is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability resulting from insufficient access control enforcement.\nThis vulnerability resides in the post-data retrieval mechanism, where the application fails to validate the ownership or authorization status of requested records.\nThe flaw allows authenticated users with the 'instructor' role to access and download sensitive metadata and full content of arbitrary posts.\nThis includes data belonging to other instructors, such as private or draft course materials that should remain restricted to authorized personnel.\nThe risk is significant as it facilitates unauthorized data exfiltration, information disclosure, and potential exposure of intellectual property or draft content.\nExploitation requires a valid user account with at least instructor-level privileges, though the attack does not require elevated administrative access.\nThe vulnerability affects all versions of the Masteriyo LMS plugin prior to 3.4.1.",
  "technicalDetails": "The root cause of this vulnerability is a failure in the server-side authorization logic within the Masteriyo LMS plugin's data export or retrieval functionality. When a user requests content or course metadata, the application fails to verify whether the requesting user maintains proper ownership or access permissions for the requested resource ID.\nThe vulnerability manifests as an Insecure Direct Object Reference (IDOR), where the system trusts the user-supplied identifier (e.g., post ID) without correlating it to the current user's session or role-based access control (RBAC) privileges.\nThe attack flow begins with an authenticated attacker possessing the instructor role. By interacting with the plugin's internal request handling for post downloads, the attacker can manipulate the parameters identifying the specific post or record to be retrieved. Because the backend logic lacks an access control check, the system processes the request by fetching the requested database records and providing the content and metadata back to the attacker.\nThis bypasses the intended multi-tenancy or logical segmentation between different instructors. An attacker can systematically enumerate post IDs to scrape unauthorized data. Since the application does not restrict the 'type' of records requested, the scope of exposure includes drafts, private courses, and potentially sensitive metadata associated with any post type managed by the LMS framework.\nAffected versions are explicitly identified as those prior to 3.4.1. The vulnerable component is the retrieval/export controller responsible for handling user-initiated data requests. There is no requirement for sophisticated bypass techniques, as the flaw is systemic to the request handling architecture itself. The network exposure is limited to authenticated users; however, the impact is severe due to the loss of confidentiality regarding course structure, proprietary teaching materials, and administrative drafts within the LMS environment.\nPost-exploitation, the attacker gains a complete view of the sensitive course repository. This may lead to the unauthorized duplication of course content, exposure of PII if contained within draft course descriptions, and the compromise of business strategy by revealing upcoming, unpublished course offerings."
}