The MasterStudy LMS plugin contains a PHP Object Injection flaw in all releases up to version 3.7.55. Attackers can send crafted serialized objects to the plugin, which the PHP engine unserializes without validation, as matched by CWE-502. This leads to the ability to execute arbitrary PHP code on the web server, providing full control over the application and potentially the underlying server.

Stylemix has developed the MasterStudy LMS plugin for WordPress. All users running versions up to and including 3.7.55 are impacted. No other vendors or products are listed.

The vulnerability scores a CVSS of 8.8, indicating a high severity risk, and is not listed in the CISA KEV catalog. The EPSS score is not available, so the exact exploitation probability is unknown; however, the lack of a KEV listing suggests that no widespread active exploits have been documented publicly as of the last update. The likely attack vector involves crafting a malicious HTTP request containing a serialized object to a vulnerable endpoint of the plugin. Successful exploitation would result in arbitrary code execution on the WordPress site, enabling attackers to compromise the entire application or server.