CyberRota Analysis
AI-GeneratedThe Masteriyo LMS plugin for WordPress is susceptible to unauthorized data deletion due to a lack of capability checks in the 'delete_item_permissions_check' function, affecting all versions up to 2.2.0. This vulnerability allows unauthenticated attackers to delete arbitrary course progress records for any student, potentially disrupting educational activities and compromising data integrity. WordPress site administrators using this plugin should prioritize applying the necessary updates to mitigate this risk.
Original NVD Description
The Masteriyo LMS plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the 'delete_item_permissions_check' function in the CourseProgressItemsController in all versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to delete arbitrary course progress records belonging to any student.