Live › vulnerability › CVE-2026-118090
MasterStudy LMS versions up to and including 3.7.55 let a logged-in subscriber user submit data that is unsafely deserialized as a PHP object. An attacker with a subscriber account may be able to run code or change data on the site, with the exact impact depending on available gadget chains, which the sources do not describe.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 19:25 UTC. All times on this page are UTC.
Sites running the MasterStudy LMS WordPress plugin at version 3.7.55 or older, especially where anyone can register as a subscriber. Sites on a newer release or without this plugin can skip it. The sources do not describe the exact code path or configuration required.
No product ranges from the sources yet.
masterstudy-lms-learning-management-system; 3.7.55 or older is affected.3.7.55; the exact fixed version is unknown from the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Subscriber PHP Object Injection in MasterStudy LMS <= 3.7.55 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-118090")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.