Critical· 9.9official fix available
CVE-2026-82845
The Masteriyo LMS WordPress plugin before version 3.4.1 can deserialize user‑supplied data, allowing attackers to inject PHP objects that can write files or execute code on the server. This flaw can be triggered even by users with minimal privileges.
publishedSep 12, 2026
last modifiedSep 12, 2026
sourcesNVD
severity · cvss
9.9
critical · how bad it is
exploitation · epss
<1%
6th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Oct 12, 2026
An official fix is available, so this entry is kept for 30 days and then removed automatically.
01
Who is affected
WordPress sites running the Masteriyo LMS plugin older than version 3.4.1.
02
Real-world impact
An attacker could write arbitrary files or run PHP code on the server, potentially taking full control of the site.
03
Why this severity
The CVSS score of 9.9 reflects that the vulnerability is network‑reachable, requires low effort, and grants attackers high confidentiality, integrity, and availability impact.
04
What to do about it
official fix available
recommended steps
- 01Upgrade the Masteriyo LMS plugin to version 3.4.1 or later.
NVD-referenced vendor advisory
05
Timeline
- Sep 12, 2026 · 1d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 12, 2026 · 21h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
06
How it’s attacked
Attack vectorNetwork (remote)
Attack complexityLow
Privileges requiredLow
User interactionNone needed
ScopeChanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
07
References & advisories
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →