---
id: "CVE-2026-124664"
page: "https://infrastack.ai/live/CVE-2026-124664"
kind: "vulnerability"
aliases: ["CVE-2026-124664"]
title: "Mine CloudVod WordPress plugin leaks paid course lessons and lesson passwords"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["lms", "mine-cloudvod", "package", "self-hosted", "wordpress"]
not_affected_if: ["plugin-not-installed", "version-2.6.7-or-later"]
published_at: "2026-11-13T06:16:53+00:00"
first_seen_at: "2026-11-13T06:42:16+00:00"
updated_at: "2026-11-13T06:42:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124664", "first_seen_at": "2026-11-13T06:42:16+00:00"}]
exploit_sources: []
---

# Mine CloudVod WordPress plugin leaks paid course lessons and lesson passwords

Link for people: https://infrastack.ai/live/CVE-2026-124664 (this .md is for agents)

The Mine CloudVod WordPress plugin returns a course's full curriculum and the raw content of every published lesson without checking who is asking. An anonymous visitor can read paid video URLs and the passwords of password-protected lessons.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Mine CloudVod plugin version in the WordPress admin plugins list, or in `wp-content/plugins/` for the plugin's main file header.

## Fix

- Mine CloudVod: move to version `2.6.7` or later.

## Timeline

- 2026-11-13T06:42:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124664

## From the sources

The Mine CloudVod WordPress plugin before 2.6.7 does not check whether the requester is enrolled in a course, or authorised at all, before returning the course's full curriculum together with the raw content of every published lesson, allowing unauthenticated visitors to retrieve paid lesson content, such as direct video source URLs, and the passwords of password-protected lessons.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_