The vulnerability is PHP Object Injection through the import_all_courses function, allowing authenticated administrators to create a malicious object during deserialization. Although the injection alone does not execute code, it can be leveraged if a point‑of‑call (POP) chain exists in another plugin or theme, enabling the attacker to delete files, exfiltrate data or run arbitrary code. The weakness is identified as CWE‑502.

All installations of the Academy LMS – WordPress LMS Plugin for Complete eLearning Solution (kodezen) on WordPress sites that are version 3.3.8 or earlier are affected.

The CVSS score of 7.2 indicates high severity when a POP chain is available, but the EPSS score of less than 1% reflects a low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. An attacker with administrator access can use the import functionality to inject a crafted object, and if the site also runs a plugin or theme that contains a POP chain, the injection can lead to remote code execution, data loss or file deletion. Sites that do not have such third‑party components face limited risk, while those that do should treat this as a material threat.