CVE-2026-82845: Deserialization of Untrusted Data

The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowing users with a minimal account to inject arbitrary PHP objects and, by way of a class shipped in a library bundled with the Masteriyo LMS...

CVE-2026-62132

Subscriber Broken Access Control in Masteriyo - LMS = 3.4.0 versions...

CVE-2026-62107

Unauthenticated PHP Object Injection in Masteriyo - LMS = 3.4.0 versions...

EUVD-2026-76205

Subscriber Broken Access Control in Masteriyo - LMS = 3.4.0 versions...

CVE-2026-62132

CVE-2026-62132 is a Broken Access Control vulnerability affecting the Masteriyo – LMS WordPress plugin in versions ≤ 3.4.0 . The flaw allows users with the Subscriber role to bypass access controls, resulting in a low integrity impact (CVSS 3.1 score: 5.3 MEDIUM ). The vulnerability was discovere...

CVE-2026-62132 WordPress Masteriyo - LMS plugin <= 3.4.0 - Broken Access Control vulnerability

Subscriber Broken Access Control in Masteriyo - LMS = 3.4.0 versions...

CVE-2026-62132 WordPress Masteriyo - LMS plugin <= 3.4.0 - Broken Access Control vulnerability

Subscriber Broken Access Control in Masteriyo - LMS = 3.4.0 versions...

CVE-2026-62107 WordPress Masteriyo - LMS plugin <= 3.4.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Masteriyo - LMS = 3.4.0 versions...

CVE-2026-62107 WordPress Masteriyo - LMS plugin <= 3.4.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Masteriyo - LMS = 3.4.0 versions...

CVE-2026-62107

Masteriyo – LMS is a WordPress LMS plugin affected by an unauthenticated PHP Object Injection vulnerability in versions ≤ 3.4.0 . The flaw allows an attacker to inject a malicious serialized PHP object, potentially leading to full compromise of the site. The Patchstack CVSS 3.1 score is 8.8 (HIGH...

EUVD-2026-76212

Unauthenticated PHP Object Injection in Masteriyo - LMS = 3.4.0 versions...

WordPress Masteriyo - LMS plugin <= 3.4.0 - PHP Object Injection vulnerability

WordPress Masteriyo - LMS plugin = 3.4.0 - PHP Object Injection vulnerability discovered by 20kilograma in WordPress Plugin Masteriyo - LMS versions = 3.4.0...

PT-2026-90030

Subscriber Broken Access Control in Masteriyo - LMS = 3.4.0 versions...

CVE-2026-62107: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Masteriyo - LMS = 3.4.0 versions...

WordPress Masteriyo - LMS plugin <= 3.4.0 - Broken Access Control vulnerability

WordPress Masteriyo - LMS plugin = 3.4.0 - Broken Access Control vulnerability discovered by MYUNGYONG LEE in WordPress Plugin Masteriyo - LMS versions = 3.4.0...

CVE-2026-82848

The Masteriyo LMS WordPress plugin before 3.4.0 does not perform any authorization check before returning a course enrolment record over its REST API, allowing unauthenticated users to read any learner's enrolment status, timestamps and course-progress data by walking sequential record identifier...

WordPress Masteriyo LMS plugin 1.3.1-2.3.3 - Unauthenticated Course Enrollment Disclosure vulnerability

Unauthenticated Course Enrollment Disclosure vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Masteriyo - LMS versions 1.3.1-2.3.3...

CVE-2026-82848 Masteriyo LMS 1.3.1 - 2.3.3 - Unauthenticated Course Enrollment Disclosure

The Masteriyo LMS WordPress plugin before 3.4.0 does not perform any authorization check before returning a course enrolment record over its REST API, allowing unauthenticated users to read any learner's enrolment status, timestamps and course-progress data by walking sequential record identifier...

CVE-2026-82848

The Masteriyo LMS WordPress plugin (versions before 3.4.0 ) is vulnerable to an unauthenticated course enrollment disclosure due to a missing authorization check on its REST API . An attacker can walk sequential record identifiers to read sensitive data, including learner enrolment status , times...

EUVD-2026-74712

The Masteriyo LMS WordPress plugin before 3.4.0 does not perform any authorization check before returning a course enrolment record over its REST API, allowing unauthenticated users to read any learner's enrolment status, timestamps and course-progress data by walking sequential record identifier...