{
 "id": "WPSEC-2026-1834",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1834/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1834/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1834/index.md",
 "title": "MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.55 - Authenticated (Subscriber+) PHP Object Injection via LearnPress Migration Tool",
 "description": "The MasterStudy LMS WordPress Plugin plugin for WordPress is vulnerable to PHP Object Injection via the LearnPress migration tool in versions 3.7.54 through 3.7.55. This is due to LearnPress data being deserialized with maybe_unserialize(), including the '_lp_extra_info' user meta, which LearnPress lets a user set to a string of their choice from their own profile. Because get_user_meta() already unserializes the value once, a serialized string stored there is unserialized a second time. This makes it possible for authenticated attackers, with Subscriber-level access and above, on sites that have LearnPress data, to inject a PHP object that is created when an administrator runs the LearnPress migration. If a POP chain is present via another plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.",
 "plugin": {
  "slug": "masterstudy-lms-learning-management-system",
  "name": "MasterStudy LMS WordPress Plugin – for Online Courses and Education",
  "full_name": "MasterStudy LMS WordPress Plugin – for Online Courses and Education",
  "wordpress_org": "https://wordpress.org/plugins/masterstudy-lms-learning-management-system/",
  "advisories_url": "https://wpsec.com/vuln/plugin/masterstudy-lms-learning-management-system/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/masterstudy-lms-learning-management-system"
 },
 "type": "OBJECT INJECTION",
 "cwe": [
  "CWE-502"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.5,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": "3.7.54",
    "from_inclusive": true,
    "to": "3.7.56",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 3.7.54 before 3.7.56"
  ]
 },
 "introduced_in": "3.7.54",
 "fixed_in": "3.7.56",
 "remediation": "Update to 3.7.56 or later.",
 "fix_released": "2026-10-27T11:07:12+00:00",
 "published": "2026-10-28T11:50:08+00:00",
 "updated": "2026-10-28T09:11:42.221943+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1834/",
  "https://plugins.svn.wordpress.org/masterstudy-lms-learning-management-system/tags/3.7.56/",
  "https://wordpress.org/plugins/masterstudy-lms-learning-management-system/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/masterstudy-lms-learning-management-system",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Low",
  "as_of": "2026-10-28"
 }
}