Unauthenticated PHP Object Injection in Masteriyo - LMS <= 3.4.0 versions.

Published September 11, 2026 CVE-2026-62107

A serious flaw in the Masteriyo LMS plugin for WordPress lets an attacker send rigged data to a site without logging in first. If the site has certain other code installed, that data can trick WordPress into running commands, altering the database, or crashing the site.

Severity
HighCVSS 3.1 · 8.8 · patchstack.com
Fix
Fixed in 3.4.1Fix recorded today
Affected versions
through 3.4.0
Weakness
CWE-502Deserialization of Untrusted Data
Affects
Masteriyo - LMS
Exploited
Not confirmedNo confirmation recorded
CISA SSVC
No known exploitationAutomatable: no · Technical impact: total
EU ID
EUVD-2026-76212ENISA vulnerability database

How it works

  • Masteriyo LMS unsafely converts attacker-supplied data back into PHP objects, a process called PHP Object Injection.
  • An attacker does not need an account or password to send this data to the site.
  • On its own this only creates unexpected objects in memory.
  • But if another plugin or WordPress core code on the same site contains a compatible chain of methods, called a POP chain, the attacker can use that chain to run code, change database records, read files, or crash the site.
  • The plugin's maker, ThemeGrill, fixed the underlying flaw in version 3.4.1.

What to do

Check your WordPress admin dashboard under Plugins for "Masteriyo - LMS" and note its listed version. Compare that version against 3.4.0; any version at or below that number is affected, and no login or special access is needed for an attacker to send the malicious data. Note that the plugin being present and outdated does not by itself prove your specific site can be exploited, since that also depends on other code installed on the site.

Update the Masteriyo - LMS plugin to version 3.4.1 or later through your WordPress admin dashboard or hosting control panel. If you cannot update immediately, ask your host or developer to apply a mitigation or temporarily deactivate the plugin. Watch the Patchstack advisory for any updates on the fix.

Technical details

Affected software: Masteriyo - LMSWordPress plugin by masteriyo

CVE-2026-62107 is an unauthenticated PHP Object Injection (CWE-502) in the Masteriyo - LMS WordPress plugin, versions up to and including 3.4.0. The plugin deserializes attacker-controlled input without proper validation, allowing injection of arbitrary PHP objects. Actual impact (code execution, SQL injection, path traversal, or denial of service) depends on the presence of a usable POP gadget chain elsewhere in the site's codebase.

CVSS v3.1 score is 8.8 (network, low complexity, no privileges or user interaction required, high confidentiality/integrity/availability impact). Fixed in version 3.4.1. No evidence of active exploitation has been reported as of publication.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required Low Attacker needs a basic user account
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Open in FIRST.org calculator

References

View Original Source