Deserialization Vulnerability in Masteriyo LMS WordPress Plugin
CVE-2026-82845
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 12 September 2026
Badges
What is CVE-2026-82845?
The Masteriyo LMS WordPress plugin versions prior to 3.4.1 contain a deserialization vulnerability that permits unauthorized execution of arbitrary PHP objects. This security flaw allows users with minimal access to insert user-supplied metadata into the application, which can be exploited to execute harmful code on the server. Furthermore, there exists a less severe variant of the issue that can be exploited without user authentication, resulting in arbitrary file writes instead of direct code execution. Remediation through updating to the latest version is highly recommended to mitigate potential risks.
Affected Version(s)
Masteriyo LMS 0 < 3.4.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.