Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-82845: Masteriyo LMS plugin may let low‑privilege users run code
CVE-2026-82845 · published 1 month ago
Summary
Versions of the Masteriyo LMS WordPress plugin before 3.4.1 can accept crafted data that is turned back into executable objects when the system reads it. This lets users with only a basic account, or even someone without an account, insert malicious code or overwrite files on the server. Upgrade the plugin to version 3.4.1 or later and ensure only trusted users can add metadata.
What to do
- Update unknown masteriyo lms to version 3.4.1 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | masteriyo lms | < 3.4.1 |
Original advisory text
The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowing users with a minimal account to inj...
The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowing users with a minimal account to inject arbitrary PHP objects and, by way of a class shipped in a library bundled with the Masteriyo LMS WordPress plugin before 3.4.1, write and execute arbitrary code on the server. A weaker form of the same issue is reachable without an account and yields an arbitrary file write rather than code execution.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
9.9
Critical
Type
CWE-502Deserialization of Untrusted Data
Timeline
Published12 Sep 2026
Updated11 Oct 2026
First seen12 Sep 2026
Track software like this
Free during beta