Masteriyo LMS Deserialization Flaw Lets Low-Privilege Users Hit RCE

Executive Summary

A critical PHP object injection vulnerability (CVE-2026-82845) has been disclosed in the Masteriyo LMS WordPress plugin, used to build and sell online courses. The plugin does not prevent user-supplied values stored as metadata from being unsafely deserialized when read back. A user with only a minimal account can inject arbitrary PHP objects and, via a class shipped in a bundled library, write and execute arbitrary code on the server.

CVSS Score: 9.9 (Critical)

A weaker, unauthenticated variant of the same flaw is also reachable, though it yields an arbitrary file write rather than direct code execution — still a serious foothold on its own.

Vulnerability Overview

Affected Versions

Attack Vector

1. Attacker registers or already holds a minimal-privilege account
   (e.g. a student enrolled in a course)
2. Attacker submits crafted metadata that the plugin later deserializes
   without validation
3. Deserialization instantiates a PHP object from a class bundled with
   the plugin's dependencies
4. That object's magic methods are abused to write and execute arbitrary
   code on the server
5. Unauthenticated attackers can reach a weaker path in the same flaw
   to achieve arbitrary file write without any account

Impact of Successful Exploitation

Related Vulnerabilities Disclosed Alongside This CVE

WPScan disclosed several additional Masteriyo LMS issues in the same batch:

Sites running Masteriyo LMS should patch for all four in the same maintenance window.

Immediate Remediation

Step 1: Update to Version 3.4.1

# Via WP-CLI
wp plugin update learning-management-system
 
# Verify the installed version
wp plugin get learning-management-system --field=version

Or update through WordPress admin: Plugins > Installed Plugins > Masteriyo LMS > Update Now.

Step 2: Scan for Existing Compromise

# Search for recently modified or unexpected PHP files
find /path/to/wordpress/wp-content/ -name "*.php" -newer /path/to/wordpress/wp-includes/version.php -type f
 
# Verify WordPress core integrity
wp core verify-checksums

If Immediate Patching Is Not Possible

1. Restrict new student/course enrolment registration to trusted users only
2. Disable the plugin if it is not business-critical until patched
3. Deploy WAF rules targeting suspicious serialized-PHP patterns (O:, a:) in form submissions

Post-Remediation Steps

1. Confirm plugin updated to 3.4.1 or later
2. Audit low-privilege accounts for unusual activity
3. Scan the installation for webshells and unauthorized file writes
4. Rotate all credentials — WordPress admin, database, API keys
5. Review course-enrolment endpoints for the related access-control issues (CVE-2026-82848)

References

• OffSeq Threat Radar — CVE-2026-82845 CWE-502 Deserialization of Untrusted Data in Masteriyo LMS
• VulDB — CVE-2026-82845 in LMS Plugin
• NIST NVD — CVE-2026-82845

Related Reading

• Critical RCE in WPvivid Backup Plugin Threatens 900,000+
• DS Ad Rotator Plugin Flaw Allows Unauthenticated RCE on WordPress