CVE-2026-82851: The Masteriyo LMS WordPress plugin before 3.4.1 does not verify ownership of, or restrict the type of, the records a us

The Masteriyo LMS WordPress plugin before version 3.4.1 has a security flaw where it doesn't check if a user actually owns the content they're trying to download or limit what type of files they can access. This means instructors can download other instructors' private and draft courses, including all their content and metadata (information about the courses).