The Coschool LMS plugin accepts serialized PHP objects without proper validation, allowing an attacker to inject malicious objects that are later deserialized by the plugin. This deserialization flaw can lead to remote code execution, giving an adversary full system compromise if the plugin instance runs with elevated privileges. The weakness is classified as CWE-502, indicating a deserialization of untrusted data flaw.

Codexpert, Inc publishes the Coschool LMS plugin for WordPress. Versions 1.4.3 and earlier are affected; any site running these or earlier releases of the plugin is vulnerable.

The CVSS score of 9.8 places this vulnerability in the Critical category, although the EPSS score of <1% suggests a low likelihood of mass exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog, but the potential for arbitrary code execution warrants immediate attention. Attackers would likely exploit the flaw by sending crafted serialized data through user‑input fields or by manipulating URLs that trigger the plugin’s deserialization logic; this inference is based on the stated deserialization of untrusted data. If successful, the attacker could execute arbitrary PHP code, compromise the WordPress installation, and potentially move laterally within the underlying server.