PHP Object Injection in Masteriyo LMS WordPress Plugin

Executive Summary

This vulnerability is a PHP Object Injection issue in the Masteriyo LMS WordPress plugin versions before 3.4.1. User-supplied metadata values are not properly sanitized when deserialized, allowing attackers with a minimal account to inject arbitrary PHP objects. This can lead to remote code execution on the server due to a vulnerable class in a bundled library.

Useful 0 Not Useful 0

Detection Guidance

Check if your WordPress site uses the Masteriyo LMS plugin version prior to 3.4.1. Log in as a Subscriber or higher and inspect serialized metadata inputs for suspicious values. Use WPScan to scan for vulnerable versions: wpscan --url <target_url> --enumerate vp,vt.

Useful 0 Not Useful 0

Impact Analysis

Attackers with a Subscriber-level account or higher can exploit this to execute arbitrary code on the server. Without authentication, attackers can perform arbitrary file writes. The impact includes potential server compromise, data theft, or further attacks on the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access, data breaches, or code execution, which may violate GDPR, HIPAA, or other regulations. Compliance risks include data exposure, lack of access controls, and failure to protect sensitive information.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Masteriyo LMS plugin to version 3.4.1 or later immediately. Remove or disable the plugin if updates are not possible. Restrict user roles to the minimum required permissions and monitor for unauthorized file writes or code execution.

Useful 0 Not Useful 0