Unauthenticated users can delete any content managed by the Masteriyo – LMS plugin when running a version 3.4.3 or earlier. The vulnerability allows removal of posts, pages or other custom post types, resulting in data loss and potential disruption of course material. It is based on a missing authorization check and is identified as CWE-862.

The flaw affects installations of the Masteriyo – LMS WordPress plugin up to and including version 3.4.3. Any site running the plugin in that version range is vulnerable, regardless of other security measures, because the check is performed at the plugin level.

The CVSS score of 6.5 indicates a medium severity vulnerability. EPSS data is not available, and the vulnerability is not listed in CISA KEV. The likely attack vector is a direct HTTP request to an internal endpoint that processes delete actions—without requiring authentication. Once accessed, an attacker can trigger arbitrary removal of content, which could expose the site to data integrity risks.