Description

Unauthenticated PHP Object Injection in Masteriyo - LMS <= 3.4.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-11T19:17:43.583Z",
  "pubdate": "2026-09-11T19:17:43.583Z",
  "executiveSummary": "The Masteriyo - LMS plugin for WordPress, specifically versions 3.4.0 and below, is susceptible to an unauthenticated PHP Object Injection vulnerability.\nThis vulnerability stems from the insecure deserialization of user-supplied input, which can be leveraged by an unauthenticated attacker to inject arbitrary PHP objects into the application context.\nSuccessful exploitation allows for critical security impacts, including Remote Code Execution (RCE), arbitrary file deletion, or unauthorized administrative actions, depending on the available gadget chains present within the application's codebase or environment.\nThe flaw exists due to the lack of rigorous input validation and the use of the insecure unserialize() function on untrusted data provided via HTTP requests.\nBecause the vulnerability is unauthenticated, it presents a high-risk scenario for exposed installations, as no prior access or interaction with the WordPress administrative interface is required.\nOrganizations utilizing Masteriyo - LMS are at significant risk of total server compromise if the underlying environment contains compatible gadget chains, such as those found in common WordPress core files, themes, or other installed plugins.",
  "technicalDetails": "The core of this vulnerability lies in the improper handling of serialized data within the Masteriyo - LMS plugin. In PHP, the unserialize() function converts a stored representation of a value back into a PHP object. When this function processes user-controlled input without adequate validation or sanitization, it creates an entry point for PHP Object Injection.\nAn unauthenticated attacker can craft a malicious serialized string containing a specific class structure. When this payload is passed to the vulnerable plugin component, the unserialize() function instantiates the defined object. If the application environment includes 'magic methods' (such as __destruct(), __wakeup(), or __toString()) within the plugin or other loaded components, the attacker can trigger these methods during object destruction or subsequent interactions.\nThe exploitation flow initiates when the attacker identifies an input vector—typically a URL parameter or a POST body field—that is directly passed to an unserialize() call within the plugin's codebase. The attacker constructs a serialized payload representing a class already defined within the WordPress environment. By carefully selecting the object property values, the attacker manipulates the internal state of the application.\nIf a suitable 'gadget chain' is available in the plugin or the WordPress core, the attacker can leverage these chains to achieve arbitrary file operations or execute system commands. For instance, if a gadget exists that facilitates file deletion via its __destruct() method, the attacker can supply an object that points to critical configuration files (e.g., wp-config.php), leading to a complete site takeover or denial of service.\nThe vulnerability is considered critical because it does not require authentication, meaning the attack can be automated and executed remotely over the network. The scope of the impact is restricted only by the classes available in the application's runtime. If the PHP configuration allows it, or if specific gadgets are present, Remote Code Execution (RCE) is often the achieved goal of such an injection. The use of modern PHP versions provides limited protection against the deserialization itself, as the logic flow is inherently compromised by the application's design choices in how it handles user input through serialization."
}