CyberRota Analysis
AI-GeneratedThe Masteriyo LMS WordPress plugin prior to version 3.4.1 is vulnerable due to improper handling of user-supplied metadata, allowing authenticated users with minimal privileges to inject arbitrary PHP objects, potentially leading to remote code execution. Additionally, unauthenticated users can exploit a less severe variant to write arbitrary files on the server. WordPress site administrators using this plugin should prioritize updating to version 3.4.1 or later to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowing users with a minimal account to inject arbitrary PHP objects and, by way of a class shipped in a library bundled with the Masteriyo LMS WordPress plugin before 3.4.1, write and execute arbitrary code on the server. A weaker form of the same issue is reachable without an account and yields an arbitrary file write rather than code execution.