Live › vulnerability › CVE-2026-116410
Masteriyo LMS, a WordPress learning-management plugin, lets unauthenticated visitors delete arbitrary content in versions up to 3.4.3. An attacker can remove course or site content without logging in.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 19:25 UTC. All times on this page are UTC.
Sites running the Masteriyo LMS WordPress plugin at version 3.4.3 or earlier are exposed. The flaw is reachable without an account, so any site running the affected version is in scope; sites without the plugin can skip it.
No product ranges from the sources yet.
wp plugin get masteriyo3.4.3; the exact fixed version is unknownEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unauthenticated Arbitrary Content Deletion in Masteriyo - LMS <= 3.4.3 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-116410")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.