{
 "id": "WPSEC-2026-2479",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2479/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2479/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2479/index.md",
 "title": "LifterLMS <= 10.3.2 - Unauthenticated Missing Authorization to Protected Media Access",
 "description": "The LifterLMS plugin for WordPress is vulnerable to unauthorized access of protected media in all versions up to, and including, 10.3.2 due to an insufficient authorization check when serving protected media files. Logged-out visitors (user ID 0) were treated as the uploader of protected media that has no author, and empty or invalid quiz IDs in the media meta were not filtered out. This makes it possible for unauthenticated attackers to download protected media files without an author that they should not be able to access.",
 "plugin": {
  "slug": "lifterlms",
  "name": "LifterLMS",
  "full_name": "LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes",
  "wordpress_org": "https://wordpress.org/plugins/lifterlms/",
  "advisories_url": "https://wpsec.com/vuln/plugin/lifterlms/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/lifterlms"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": "9.0.0",
    "from_inclusive": true,
    "to": "11.0.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 9.0.0 before 11.0.0"
  ]
 },
 "introduced_in": "9.0.0",
 "fixed_in": "11.0.0",
 "remediation": "Update to 11.0.0 or later.",
 "fix_released": "2026-11-03T13:54:52+00:00",
 "published": "2026-11-04T14:58:24+00:00",
 "updated": "2026-11-04T13:58:11.082104+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2479/",
  "https://plugins.svn.wordpress.org/lifterlms/tags/11.0.0/",
  "https://wordpress.org/plugins/lifterlms/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/lifterlms",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-04"
 }
}