Masteriyo LMS EUVD-2026-114306

Prerequisite: a target WordPress site running Masteriyo LMS plugin version 3.4.3 or earlier, reachable over the network. Per the supplied vector (AV:N/AC:L/PR:N/UI:N), no authentication and no user interaction are required, so default installations of the affected versions are exploitable remotely by unauthenticated attackers. The available sources do not describe the exact feature, endpoint, or configuration that triggers the deletion, so the specific trigger is not described in the available sources. The only firm limiting factor is version: sites updated past 3.4.3 are not in the stated affected range.

This is a genuine but mid-tier priority. The supplied CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable flaw requiring no authentication, no user interaction and low attack complexity - the easy-to-reach end of the spectrum - but the input-supplied base score is only 6.5 (MEDIUM) because the provided vector caps impact at C:L/I:L/A:N. There is a notable tension here: the vulnerability is titled 'Arbitrary Content Deletion' (a strong integrity/availability concern, CWE-862 Missing Authorization), yet the provided vector rates integrity only Low and availability None, which understates the practical effect of unauthenticated arbitrary deletion - this is why my independent assessment below raises the integrity metric. KEV status is NOT listed, so there is no confirmation of active exploitation. No EPSS score was provided in the input, so exploitation probability cannot be quantified from the data given - its absence is not evidence of low risk, it is simply missing. No verified public exploit code is present in the input; the only reference is the Patchstack advisory. The vuln.today decision label is 'this_month', consistent with a serious-but-not-emergency issue. Net: a network-reachable, unauthenticated missing-authorization bug in a widely used WordPress plugin warrants prompt patching, but with no KEV, no EPSS and no confirmed exploit, it reads as 'patch this cycle' rather than drop-everything.

A remote, unauthenticated attacker sends crafted HTTP requests to a WordPress site running Masteriyo LMS 3.4.3 or earlier, invoking a plugin endpoint that fails to verify authorization (CWE-862) before deleting content. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no login, no victim interaction and no special complexity are required against a default install. The exact triggering endpoint is not described in the available sources; no public exploit identified at time of analysis.