MasterStudy LMS EUVD-2026-114316

Requires an authenticated WordPress account at Subscriber level or higher (PR:L), making open user registration - common on LMS/course sites - the primary enabling condition. The core requirement is reaching the plugin's unsafe PHP deserialization path with attacker-controlled serialized data; meaningful impact (code execution) further depends on a usable gadget/POP chain being present in the plugin or co-installed code, which the sources do not confirm. Limiting factors: exploitation is gated by needing a valid low-privilege account, so sites that disable self-registration raise the bar; the specific vulnerable feature, endpoint, and triggering parameter are not stated in the available sources.

Signals point to a credible but not emergency-grade priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H) rates 8.8 and indicates a network-reachable flaw requiring only low privileges and no user interaction, with high impact across confidentiality, integrity and availability - consistent with CWE-502 PHP object injection that can escalate to code execution when a usable gadget (POP) chain is present. The 'Subscriber' qualifier in the title aligns with PR:L: the attacker needs an authenticated low-privilege account, which on open-registration LMS sites is trivial to obtain, somewhat offsetting the authentication barrier. No KEV listing, no EPSS score, and no verified public exploit code were provided, so there is no evidence of active exploitation or weaponization at this time. The vuln.today decision label is 'this_week' (not act_now/emergency), which matches a serious authenticated flaw lacking confirmed in-the-wild activity. Key gap: EPSS and KEV data are absent (not low - simply not supplied), and the single source is a Patchstack advisory; real impact depends on whether a gadget chain exists in the plugin or co-installed code, which the available sources do not establish.

An attacker registers or uses a low-privilege Subscriber account on a WordPress site running MasterStudy LMS <= 3.7.55, then sends a request carrying a crafted serialized PHP object to the vulnerable code path. If a suitable gadget (POP) chain is reachable in the plugin or other installed code, the unsafe deserialization can lead to high-impact compromise. No public exploit identified at time of analysis; the trigger parameter is not described in the available sources.