MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.55 - Authenticated (Subscriber+) PHP Object Injection via LearnPress Migration Tool
- ID
- WPSEC-2026-1834
- Plugin
- MasterStudy LMS WordPress Plugin – for Online Courses and Education (masterstudy-lms-learning-management-system)
- Affected
- from 3.7.54 before 3.7.56
- Remediation
- Update to 3.7.56 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-502
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-28
- Attack surface
- MasterStudy LMS WordPress Plugin – for Online Courses and Education on WPSec AttackSurface
- Fix released
- Published
Description
The MasterStudy LMS WordPress Plugin plugin for WordPress is vulnerable to PHP Object Injection via the LearnPress migration tool in versions 3.7.54 through 3.7.55. This is due to LearnPress data being deserialized with maybe_unserialize(), including the '_lp_extra_info' user meta, which LearnPress lets a user set to a string of their choice from their own profile. Because get_user_meta() already unserializes the value once, a serialized string stored there is unserialized a second time. This makes it possible for authenticated attackers, with Subscriber-level access and above, on sites that have LearnPress data, to inject a PHP object that is created when an administrator runs the LearnPress migration. If a POP chain is present via another plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
References
- https://wpsec.com/vuln/WPSEC-2026-1834/
- https://plugins.svn.wordpress.org/masterstudy-lms-learning-management-system/tags/3.7.56/
- https://wordpress.org/plugins/masterstudy-lms-learning-management-system/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS