# MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.55 - Authenticated (Subscriber+) PHP Object Injection via LearnPress Migration Tool

- **ID:** WPSEC-2026-1834
- **Plugin:** MasterStudy LMS WordPress Plugin – for Online Courses and Education (`masterstudy-lms-learning-management-system`), https://wordpress.org/plugins/masterstudy-lms-learning-management-system/
- **Affected versions:** from 3.7.54 before 3.7.56
- **Fixed in:** 3.7.56 (Update to 3.7.56 or later.)
- **Severity:** High 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-502
- **Usage among sites WPSec scans:** plugin Medium, affected versions Low (as of 2026-10-28)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/masterstudy-lms-learning-management-system
- **Fix released:** 2026-10-27
- **Published:** 2026-10-28
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1834/

## Description

The MasterStudy LMS WordPress Plugin plugin for WordPress is vulnerable to PHP Object Injection via the LearnPress migration tool in versions 3.7.54 through 3.7.55. This is due to LearnPress data being deserialized with maybe_unserialize(), including the '_lp_extra_info' user meta, which LearnPress lets a user set to a string of their choice from their own profile. Because get_user_meta() already unserializes the value once, a serialized string stored there is unserialized a second time. This makes it possible for authenticated attackers, with Subscriber-level access and above, on sites that have LearnPress data, to inject a PHP object that is created when an administrator runs the LearnPress migration. If a POP chain is present via another plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

## References

- https://wpsec.com/vuln/WPSEC-2026-1834/
- https://plugins.svn.wordpress.org/masterstudy-lms-learning-management-system/tags/3.7.56/
- https://wordpress.org/plugins/masterstudy-lms-learning-management-system/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1834/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.