{"id":"CVE-2026-124664","kind":"vulnerability","aliases":["CVE-2026-124664"],"related":[],"title":"Mine CloudVod WordPress plugin leaks paid course lessons and lesson passwords","description":"The Mine CloudVod WordPress plugin before 2.6.7 does not check whether the requester is enrolled in a course, or authorised at all, before returning the course's full curriculum together with the raw content of every published lesson, allowing unauthenticated visitors to retrieve paid lesson content, such as direct video source URLs, and the passwords of password-protected lessons.","summary":"The Mine CloudVod WordPress plugin returns a course's full curriculum and the raw content of every published lesson without checking who is asking. An anonymous visitor can read paid video URLs and the passwords of password-protected lessons.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["lms","mine-cloudvod","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed","version-2.6.7-or-later"],"how_to_check":"- Check the installed Mine CloudVod plugin version in the WordPress admin plugins list, or in `wp-content/plugins/` for the plugin's main file header.","fix":"- Mine CloudVod: move to version `2.6.7` or later.","status":"open","published_at":"2026-11-13T06:16:53+00:00","first_seen_at":"2026-11-13T06:42:16+00:00","triaged_at":"2026-11-13T06:42:26+00:00","updated_at":"2026-11-13T06:42:26+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T06:42:26Z","model":"claude-haiku-5-5","output":{"fix":"- Mine CloudVod: move to version `2.6.7` or later.","reach":"internet","title":"Mine CloudVod WordPress plugin leaks paid course lessons and lesson passwords","impact":"medium","summary":"The Mine CloudVod WordPress plugin returns a course's full curriculum and the raw content of every published lesson without checking who is asking. An anonymous visitor can read paid video URLs and the passwords of password-protected lessons.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","mine-cloudvod","lms","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"anonymous visitors read paid lesson videos and protected lesson passwords","analyst_note":"","how_to_check":"- Check the installed Mine CloudVod plugin version in the WordPress admin plugins list, or in `wp-content/plugins/` for the plugin's main file header.\n- unknown for other checks; the sources do not say which endpoint or setting to inspect.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-2.6.7-or-later"],"who_is_affected":"Sites running the Mine CloudVod WordPress plugin before 2.6.7 that sell or host paid courses are exposed, because the flaw lets anonymous visitors read lesson content. Sites without this plugin, or running 2.6.7 or later, are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000732,"input_tokens":4571,"output_tokens":550,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124664':14A,17A '-2026':13A,16A '2.6.7':73C 'allow':105C 'anonym':52B 'ask':50B 'authoris':86C 'check':47B,76C 'cloudvod':2A,21B,29B,69C 'content':41B,100C,112C 'cours':7A,34B,84C,92C 'curriculum':37B,95C 'cve':12A,15A 'direct':115C 'enrol':81C 'everi':43B,102C 'full':36B,94C 'host':25B 'leak':5A 'lesson':8A,10A,45B,66B,104C,111C,126C 'lms':18B 'mine':1A,20B,28B,68C 'mine-cloudvod':19B 'packag':22B 'paid':6A,56B,110C 'password':11A,61B,64B,121C,124C 'password-protect':63B,123C 'plugin':4A,31B,71C 'protect':65B,125C 'publish':44B,103C 'raw':40B,99C 'read':55B 'request':79C 'retriev':109C 'return':32B,90C 'self':24B 'self-host':23B 'sourc':117C 'togeth':96C 'unauthent':106C 'url':58B,118C 'video':57B,116C 'visitor':53B,107C 'whether':77C 'without':46B 'wordpress':3A,26B,30B,70C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Mine CloudVod WordPress plugin before 2.6.7 that sell or host paid courses are exposed, because the flaw lets anonymous visitors read lesson content. Sites without this plugin, or running 2.6.7 or later, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","lms","minecloudvod","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-124664':14A,17A '-2026':13A,16A 'cloudvod':2A 'cours':7A 'cve':12A,15A 'leak':5A 'lesson':8A,10A 'mine':1A 'paid':6A 'password':11A 'plugin':4A 'wordpress':3A","search_b":"'anonym':52B 'ask':50B 'check':47B 'cloudvod':21B,29B 'content':41B 'cours':34B 'curriculum':37B 'everi':43B 'full':36B 'host':25B 'lesson':45B,66B 'lms':18B 'mine':20B,28B 'mine-cloudvod':19B 'packag':22B 'paid':56B 'password':61B,64B 'password-protect':63B 'plugin':31B 'protect':65B 'publish':44B 'raw':40B 'read':55B 'return':32B 'self':24B 'self-host':23B 'url':58B 'video':57B 'visitor':53B 'without':46B 'wordpress':26B,30B","search_c":"'2.6.7':73C 'allow':105C 'authoris':86C 'check':76C 'cloudvod':69C 'content':100C,112C 'cours':84C,92C 'curriculum':95C 'direct':115C 'enrol':81C 'everi':102C 'full':94C 'lesson':104C,111C,126C 'mine':68C 'paid':110C 'password':121C,124C 'password-protect':123C 'plugin':71C 'protect':125C 'publish':103C 'raw':99C 'request':79C 'retriev':109C 'return':90C 'sourc':117C 'togeth':96C 'unauthent':106C 'url':118C 'video':116C 'visitor':107C 'whether':77C 'wordpress':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T06:16:53+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124664","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124664","severity":null,"published_at":"2026-11-13T06:16:53+00:00","modified_at":"2026-11-13T06:16:53+00:00","first_seen_at":"2026-11-13T06:42:16+00:00","fetched_at":"2026-11-13T06:42:16+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}