CVE-2026-82845: Masteriyo LMS < 3.4.1 - Subscriber+ PHP Object Injection
The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowing users with a minimal account to inject arbitrary PHP objects and, by way of a class shipped in a library bundled with the Masteriyo LMS WordPress plugin before 3.4.1, write and execute arbitrary code on the server. A weaker form of the same issue is reachable without an account and yields an arbitrary file write rather than code execution.
Affected Software
Event History
Frequently Asked Questions
Who can exploit the code-execution path?
The code-execution path requires a user with a minimal account, such as a subscriber or higher-privileged role. That user can supply malicious metadata that is later deserialized by affected plugin versions.
Can an unauthenticated attacker exploit any part of this issue?
Yes. A weaker unauthenticated path is reachable without an account, but it is described as allowing arbitrary file write rather than arbitrary code execution.
Which versions should be considered affected?
Masteriyo LMS versions before 3.4.1 are affected. Upgrade to version 3.4.1 or later.
What is the practical impact if exploitation succeeds?
An authenticated low-privilege user may be able to write and execute arbitrary code on the server through a bundled library class. An unauthenticated attacker may be able to write arbitrary files.