Description

The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowing users with a minimal account to inject arbitrary PHP objects and, by way of a class shipped in a library bundled with the Masteriyo LMS WordPress plugin before 3.4.1, write and execute arbitrary code on the server. A weaker form of the same issue is reachable without an account and yields an arbitrary file write rather than code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-09-12T06:16:26.043Z",
  "pubdate": "2026-09-12T06:16:26.043Z",
  "executiveSummary": "Masteriyo LMS WordPress plugin versions prior to 3.4.1 are susceptible to an Insecure Deserialization vulnerability. This vulnerability allows for Remote Code Execution (RCE) and Arbitrary File Write, depending on the attacker's authentication level.\nThe root cause lies in the application's improper handling of user-supplied metadata, which is insecurely deserialized when read from the database.\nAuthenticated users with minimal privileges can leverage this vulnerability to inject malicious serialized PHP objects, leading to full Remote Code Execution via a gadget chain present in a bundled library.\nUnauthenticated actors can trigger a less severe variant of the issue, resulting in an arbitrary file write. This poses a significant security risk, as it allows attackers to potentially modify or overwrite sensitive system files.\nThe vulnerability necessitates immediate action, as it bypasses standard authorization controls and provides a mechanism for unauthorized code execution and file manipulation on the server hosting the WordPress instance.",
  "technicalDetails": "The vulnerability exists due to the insecure implementation of deserialization processes within the Masteriyo LMS plugin. The application logic fails to validate or sanitize user-controlled metadata before passing it to PHP's unserialize() function upon retrieval from the database.\nFor authenticated users with minimal privileges, this flaw constitutes a critical Remote Code Execution vulnerability. An attacker can craft a malicious serialized PHP object payload. When the plugin processes this payload, it instantiates an object of a class present within a bundled third-party library. This library contains an exploitable gadget chain that, when triggered during deserialization or object destruction, allows the attacker to execute arbitrary PHP code within the context of the web server process.\nFor unauthenticated actors, the impact is slightly restricted, resulting in an arbitrary file write primitive. By manipulating the deserialized input, an attacker can influence file operations performed by the application, potentially overwriting critical configuration files or injecting malicious web shells into the server's document root.\nThe attack flow follows a predictable pattern: First, the attacker identifies a mechanism to inject serialized data into the plugin's metadata storage. Second, the attacker triggers the application to read and unserialize this data. Third, the PHP deserialization process invokes the vulnerable gadget chain, resulting in either code execution or file system manipulation.\nThe vulnerability affects all versions of the Masteriyo LMS WordPress plugin prior to 3.4.1. The flaw is fundamentally an Insecure Deserialization issue (CWE-502), exacerbated by the presence of 'gadget' classes in the bundled library that facilitate RCE.\nSuccessful exploitation requires minimal interaction once the payload is injected; the server-side process automatically performs the dangerous deserialization upon reading the tainted data from the storage layer. This provides attackers with a high degree of control over the execution environment, leading to full site compromise if RCE is achieved."
}