Masteriyo LMS 1.14.0 – 3.4.0 – Instructor+ Arbitrary Post Disclosure via IDOR | CVE 2026-82851

Description

The plugin does not verify ownership of, or restrict the type of, the records a user requests for download, allowing users with the instructor role to retrieve the full content and metadata of arbitrary posts, including other instructors' private and draft courses.

Proof of Concept

The PoC will be displayed on September 24, 2026, to give users the time to update.

Affects Plugins

learning-management-system

Fixed in 3.4.1

References

CVE

CVE-2026-82851

Classification

Type

IDOR

OWASP top 10

A5: Broken Access Control

CWE

CWE-639

CVSS

2.7 (low)

Miscellaneous

Original Researcher

Karthik Ramakrishnan

Submitter

Karthik Ramakrishnan

Verified

Yes

WPVDB ID

07664081-72c3-4f7e-9324-e0047b6e6d22

Timeline

Publicly Published

2026-09-10 (about 2 days ago)

Added

2026-09-10 (about 1 day ago)

Last Updated

2026-09-10 (about 1 day ago)

Other

Published

Title

Published

2026-08-15

Title

Online Scheduling and Appointment Booking System – Bookly < 28.0 - Authenticated (Staff+) Insecure Direct Object Reference to Sensitive Information Exposure via 'params[id]' Parameter

Published

2026-09-03

Title

Kirki 6.0.0 - 6.2.5 - Authenticated Collaboration Comment Status Modification via IDOR

Published

2026-07-20

Title

FluentBoards < 1.95.3 - Subscriber+ Cross-Board Task Disclosure via IDOR

Published

2024-04-05

Title

Profile Builder < 3.11.3 - Restricted Email Bypass

Published

2024-04-19

Title

VikBooking < 1.6.8 - Insecure Direct Object References