Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-82845

Masteriyo LMS < 3.4.1 - Subscriber+ PHP Object Injection

cve-program · severity unknownCVSS unknownCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-82845

Published

The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowing users with a minimal account to inject arbitrary PHP objects and, by way of a class shipped in a library bundled with the Masteriyo LMS WordPress plugin before 3.4.1, write and execute arbitrary code on the server. A weaker form of the same issue is reachable without an account and yields an arbitrary file write rather than code execution.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-82845

Published

Masteriyo LMS

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Unknown",
                    "product": "Masteriyo LMS",
                    "versions": [
                        {
                            "status": "affected",
                            "versionType": "semver",
                            "version": "0",
                            "lessThan": "3.4.1"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON