CVE-2026-82845 Overview
CVE-2026-82845 is a PHP Object Injection vulnerability in the Masteriyo LMS WordPress plugin versions prior to 3.4.1. The plugin fails to prevent user-supplied metadata values from being deserialized when read back from storage. Authenticated users with minimal account privileges can inject arbitrary PHP objects and achieve remote code execution by abusing a gadget chain in a bundled library. Unauthenticated attackers can trigger a weaker variant of the same flaw that results in arbitrary file write instead of code execution. The vulnerability is classified under CWE-502: Deserialization of Untrusted Data.
Critical Impact
Authenticated attackers with minimal privileges can execute arbitrary code on the underlying server, while unauthenticated attackers can write arbitrary files.
Affected Products
- Masteriyo LMS WordPress plugin versions before 3.4.1
- WordPress sites bundling vulnerable versions of the Masteriyo LMS plugin
- Any deployment exposing the plugin's metadata read paths to low-privileged or unauthenticated users
Discovery Timeline
- 2026-09-12 - CVE-2026-82845 published to NVD
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-82845
Vulnerability Analysis
The Masteriyo LMS plugin stores user-controlled input as serialized metadata and passes those values through PHP's unserialize() function when they are read back. Because the plugin does not validate, sanitize, or restrict the serialized payload, attackers can craft input containing arbitrary PHP object graphs. When PHP reconstructs those objects, magic methods such as __wakeup() or __destruct() execute automatically. The plugin ships a bundled library containing a class usable as a Property-Oriented Programming (POP) gadget. Chaining this gadget through the injected object graph allows an attacker to write attacker-controlled content to disk and execute it as PHP.
Root Cause
The root cause is unsafe deserialization of untrusted input [CWE-502]. Metadata submitted through low-privilege endpoints is persisted verbatim and later processed with unserialize() without a type-safe wrapper such as maybe_unserialize() with allowlisting, or JSON encoding. The presence of a usable gadget chain within a bundled dependency converts the deserialization primitive into a full code execution primitive.
Attack Vector
Exploitation occurs over the network against the WordPress HTTP interface. An authenticated attacker with a minimal role, such as a subscriber or student, submits a crafted serialized payload through a plugin endpoint that stores metadata. When the plugin later reads the metadata, the object chain executes and the bundled gadget writes a PHP file to a web-accessible directory. The attacker then requests that file to trigger code execution. The unauthenticated variant exercises a narrower code path that reaches the same deserialization sink but only yields arbitrary file write, still sufficient to plant webshells or overwrite configuration files.
See the WPScan Vulnerability Report for additional technical detail.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-82845
Indicators of Compromise
- New or modified PHP files in wp-content/uploads/, wp-content/plugins/masteriyo/, or other writable plugin directories not associated with a plugin update
- HTTP POST or PUT requests to Masteriyo LMS REST endpoints containing serialized PHP payloads beginning with O:, a:, or s: in request bodies
- Unexpected outbound network connections from the php-fpm or web server process shortly after Masteriyo metadata write operations
- WordPress user accounts with minimal roles submitting requests to LMS metadata endpoints at unusual frequency
Detection Strategies
- Inspect HTTP request bodies destined for Masteriyo LMS endpoints for serialized PHP patterns such as O:\d+:" and gadget class names shipped with bundled libraries
- Correlate low-privileged authenticated sessions with subsequent file creation events under the web root
- Monitor calls to unserialize() in application-layer logs where PHP error reporting or a runtime application self-protection agent is enabled
Monitoring Recommendations
- Enable file integrity monitoring on the WordPress installation directory and alert on any new .php file under wp-content/uploads/
- Log and review all REST API calls to /wp-json/masteriyo/* endpoints and retain payloads for forensic review
- Alert on web server processes spawning child processes such as sh, bash, python, or curl
How to Mitigate CVE-2026-82845
Immediate Actions Required
- Upgrade the Masteriyo LMS plugin to version 3.4.1 or later on every WordPress installation
- Audit the web root and plugin directories for unauthorized PHP files and remove any that predate the upgrade
- Rotate WordPress secrets in wp-config.php, database credentials, and API keys stored on affected hosts
- Review user accounts for unexpected role escalations or newly created administrator accounts
Patch Information
The vendor addressed the issue in Masteriyo LMS version 3.4.1. The fix removes unsafe deserialization of user-controlled metadata. Refer to the WPScan advisory for vendor references and version confirmation.
Workarounds
- Deactivate and remove the Masteriyo LMS plugin until the site can be upgraded to 3.4.1 or later
- Restrict access to Masteriyo LMS REST endpoints at the web server or web application firewall layer, blocking requests that contain serialized PHP object markers
- Prevent PHP execution within wp-content/uploads/ by adding a directory-level handler restriction in the web server configuration
- Limit self-registration and disable open enrollment on the LMS to reduce the pool of low-privileged accounts available to attackers
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
