The LearnDash LMS plugin for WordPress suffers from an information exposure vulnerability (CWE-200) in all versions up to 4.10.1. The issue arises from direct file access to uploaded assignments without adequate protection, enabling unauthenticated attackers to retrieve these files. This vulnerability has a CVSS 3.1 base score of 5.3 (medium severity), with an attack vector of network, no privileges required, and no user interaction needed. No patch or vendor advisory is currently referenced, and the product is not a cloud service.

An unauthenticated attacker can access sensitive uploaded assignment files that should be protected, potentially leading to unauthorized disclosure of user-submitted data. There is no indication of impact on integrity or availability. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting direct access to uploaded assignment files via web server configuration or other access controls to mitigate exposure.