{"id":"CVE-2026-116410","kind":"vulnerability","aliases":["CVE-2026-116410"],"related":[],"title":"Masteriyo LMS WordPress plugin: unauthenticated content deletion up to 3.4.3","description":"Unauthenticated Arbitrary Content Deletion in Masteriyo - LMS <= 3.4.3 versions.","summary":"Masteriyo LMS, a WordPress learning-management plugin, lets unauthenticated visitors delete arbitrary content in versions up to 3.4.3. An attacker can remove course or site content without logging in.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["masteriyo-lms","package","self-hosted","wordpress"],"not_affected_if":["patched-version","plugin-not-installed"],"how_to_check":"- Check the installed Masteriyo LMS plugin version in the WordPress admin plugin list, or with `wp plugin get masteriyo`","fix":"- Masteriyo LMS: move to a version later than `3.4.3`; the exact fixed version is unknown","status":"open","published_at":"2026-10-30T19:18:14+00:00","first_seen_at":"2026-10-30T19:25:28+00:00","triaged_at":"2026-10-30T19:26:23+00:00","updated_at":"2026-10-30T19:26:23+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T19:26:23Z","model":"claude-haiku-5-5","output":{"fix":"- Masteriyo LMS: move to a version later than `3.4.3`; the exact fixed version is unknown","reach":"internet","title":"Masteriyo LMS WordPress plugin: unauthenticated content deletion up to 3.4.3","impact":"medium","summary":"Masteriyo LMS, a WordPress learning-management plugin, lets unauthenticated visitors delete arbitrary content in versions up to 3.4.3. An attacker can remove course or site content without logging in.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","masteriyo-lms","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated visitors delete arbitrary site content","analyst_note":"Confirm the fixed version and the vulnerable endpoint from the NVD entry or the plugin's changelog; the sources give only the version range.","how_to_check":"- Check the installed Masteriyo LMS plugin version in the WordPress admin plugin list, or with `wp plugin get masteriyo`\n- unknown: the sources do not name the affected endpoint or setting","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","patched-version"],"who_is_affected":"Sites running the Masteriyo LMS WordPress plugin at version 3.4.3 or earlier are exposed. The flaw is reachable without an account, so any site running the affected version is in scope; sites without the plugin can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000691,"input_tokens":4071,"output_tokens":568,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116410':13A,16A '-2026':12A,15A '3.4.3':10A,43B,61C 'arbitrari':37B,55C 'attack':45B 'content':6A,38B,51B,56C 'cours':48B 'cve':11A,14A 'delet':7A,36B,57C 'host':23B 'learn':30B 'learning-manag':29B 'let':33B 'lms':2A,19B,26B,60C 'log':53B 'manag':31B 'masteriyo':1A,18B,25B,59C 'masteriyo-lm':17B 'packag':20B 'plugin':4A,32B 'remov':47B 'self':22B 'self-host':21B 'site':50B 'unauthent':5A,34B,54C 'version':40B,62C 'visitor':35B 'without':52B 'wordpress':3A,24B,28B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Masteriyo LMS WordPress plugin at version 3.4.3 or earlier are exposed. The flaw is reachable without an account, so any site running the affected version is in scope; sites without the plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T19:18:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116410","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116410","severity":null,"published_at":"2026-10-30T19:18:14+00:00","modified_at":"2026-10-30T19:22:27+00:00","first_seen_at":"2026-10-30T19:25:28+00:00","fetched_at":"2026-10-30T19:25:28+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}