CVE-2026-124664: Mine CloudVod < 2.6.7 - Unauthenticated Paid Lesson Content Disclosure
The Mine CloudVod WordPress plugin before 2.6.7 does not check whether the requester is enrolled in a course, or authorised at all, before returning the course's full curriculum together with the raw content of every published lesson, allowing unauthenticated visitors to retrieve paid lesson content, such as direct video source URLs, and the passwords of password-protected lessons.
Event History
Frequently Asked Questions
Who can access the exposed lesson material?
Any unauthenticated visitor can retrieve it. The plugin does not verify course enrollment or any other authorization before returning the curriculum and published lesson content.
What content may be disclosed?
The disclosure includes the full course curriculum and raw content for every published lesson. This can expose direct video source URLs and passwords for password-protected lessons.
Are only paid or password-protected lessons affected?
Published lessons are returned without authorization checks, including paid lesson content. Password-protected lesson passwords may also be exposed as part of the raw lesson content.
Which plugin versions are affected?
Mine CloudVod versions before 2.6.7 are affected.