EUVD-2026-76212
GHSA-m3pj-g42c-wf98
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend serialized PHP payload to plugin endpoint
-
DeliveryTrigger unserialize() on attacker-controlled data
-
ExploitInstantiate gadget chain via magic methods
-
ExecutionExecute arbitrary PHP/OS commands
-
ImpactAchieve full server compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The vulnerable endpoint must be reachable over the network and the target must be running Masteriyo LMS plugin version 3.4.0 or earlier on a WordPress installation. The critical ambiguity is authentication level: the Patchstack title states the attack is unauthenticated (no WordPress account required), but the supplied CVSS vector specifies PR:L, which in WordPress context means subscriber-level authentication - i.e., a registered but unprivileged user account. Exploitation impact also depends on whether a suitable POP gadget chain exists among the PHP classes loaded by WordPress and co-installed plugins; this is typically satisfied on any standard WordPress installation with several active plugins. No specific non-default configuration or feature toggle is identified as a prerequisite beyond having the plugin installed and active. |
| Impact | The provided CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) signals a high-severity network-exploitable flaw requiring only low-privilege access. However, the Patchstack disclosure title explicitly labels this 'Unauthenticated,' directly contradicting PR:L - if PR:N is correct the actual CVSS score climbs to approximately 9.8. This discrepancy is a critical ambiguity: PR:L in WordPress context typically means subscriber-level authentication (any registered user), while PR:N means no account at all. Either scenario is severe, but the distinction matters for environments with open user registration. EPSS data is not provided. No KEV listing and no confirmed public POC, so active exploitation is not currently established. Real-world impact depends heavily on the available PHP gadget chain; WordPress sites running multiple plugins vastly increase the likelihood of exploitable chains. This should be treated as high priority for all sites running Masteriyo LMS <= 3.4.0, with the unauthenticated claim warranting assumption of worst-case PR:N until the vendor clarifies. |
| Exploit ScenarioDerived | An attacker sends a crafted HTTP request to the vulnerable Masteriyo LMS plugin endpoint containing a malicious serialized PHP object payload. Upon deserialization, the payload triggers a POP gadget chain assembled from PHP classes loaded by WordPress and its active plugins, ultimately executing arbitrary operating system commands or writing a PHP webshell to the server. If the vulnerability is truly unauthenticated as stated in the Patchstack title, no prior account creation or credential theft is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 11, 2026
PHP Object Injection in the Masteriyo LMS WordPress plugin (versions <= 3.4.0) allows remote attackers to inject a crafted serialized PHP payload, potentially enabling arbitrary code execution via a PHP gadget chain present in the environment. The vulnerability is described as unauthenticated in the Patchstack disclosure title, though the supplied CVSS vector specifies PR:L - a discrepancy that materially affects real-world risk assessment and requires vendor clarification. No public exploit code or CISA KEV listing has been identified at time of analysis.
RemediationAI
Update the Masteriyo LMS plugin to the version released after 3.4.0 as documented in the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/learning-management-system/vulnerability/wordpress-masteriyo-lms-plugin-3-4-0-php-object-injection-vulnerability - verify the exact patched version number from that page, as no specific fix version number was provided in the source data. If an immediate update is not feasible, consider disabling the plugin until patching is possible; doing so will remove LMS functionality but eliminates the attack surface entirely. Deploying a web application firewall rule to block serialized PHP payloads (strings beginning with 'O:', 'a:', 's:' patterns) at the perimeter can serve as a partial compensating control but is bypassable and should not substitute for patching. If the vulnerability is confirmed unauthenticated, disabling open user registration provides no meaningful protection.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
PHP Object Injection (CWE-502: Deserialization of Untrusted Data) arises when a PHP application passes user-controlled data to PHP's native unserialize() function without sanitization. An attacker supplies a crafted serialized string that, when deserialized, instantiates arbitrary PHP class objects. If a suitable Property-Oriented Programming (POP) gadget chain exists in the loaded PHP class space - common in WordPress environments with multiple active plugins - the attacker can chain __wakeup(), __destruct(), or __toString() magic methods to achieve file writes, remote code execution, or full server compromise. The affected product is identified by CPE cpe:2.3:a:masteriyo:masteriyo_-_lms:*:*:*:*:*:*:*:* covering all versions through 3.4.0, a WordPress-based Learning Management System plugin.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Patchstack explicitly labels this unauthenticated; PR:N applied over supplied PR:L pending vendor clarification, as the description is authoritative on access requirements.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated PHP Object Injection in Masteriyo - LMS <= 3.4.0 versions.
Executive ViewAI
Masteriyo LMS plugin (versions 3.4.0 and earlier) used for WordPress learning platforms contains a code injection vulnerability enabling potential remote code execution and unauthorized access to student data and course content. A material conflict exists between vendor sources regarding whether attackers need valid credentials or can operate unauthenticated, requiring immediate vendor clarification to properly assess organizational risk exposure.
No vendor-released patch identified at time of analysis. Until patched, restrict administrative access to Masteriyo LMS to trusted administrators only, deploy Web Application Firewall rules to detect and block suspicious serialization attempts, enforce strong password policies for all WordPress administrator accounts, maintain automated daily backups to enable rapid recovery, and implement system monitoring to detect unauthorized code execution or data access patterns.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB