Threats tagged 'ghsa-xmcc-44j6-5w8v'

The Mine CloudVod WordPress plugin versions prior to 2.6.7 have an authorization flaw that allows unauthenticated users to access the full curriculum and raw content of published lessons, including paid video URLs and passwords for protected lessons. This exposure occurs because the plugin does not verify if the requester is enrolled or authorized before disclosing this sensitive content.