The Moodle Custom Certificate plugin contains a critical security flaw that allows authorized teachers to access and modify certificate data across different courses, leading to unauthorized data disclosure.

The core_get_fragment and mod_customcert_save_element services fail to verify the context of a supplied elementid. This allows an authenticated teacher with management permissions in one course to manipulate certificates in any other course on the Moodle site.

This vulnerability enables cross-course data tampering and information disclosure, which can undermine the integrity of academic certifications. The CVSS score of 9.6 reflects the high impact on data integrity and confidentiality within the educational platform, potentially allowing for the unauthorized issuance of certificates.

Immediate Action: Update the Custom Certificate plugin to version 4.4.9 or 5.0.3 immediately through the Moodle plugin management interface.

Proactive Monitoring: Audit certificate modification logs for any changes made by users to courses they are not officially assigned to manage.

Compensating Controls: Review and restrict the mod/customcert:manage capability to only the most trusted administrative users until the patch is applied.

Public Exploit Available: false

Moodle administrators must update the mod_customcert plugin to the fixed versions immediately. This action is necessary to prevent unauthorized users from compromising the validity of certificates across the entire installation.