A high-severity PHP Object Injection vulnerability in the Academy LMS plugin for WordPress could allow authenticated administrators to achieve arbitrary code execution if a suitable POP chain is present.

This flaw exists in the import_all_courses function, which improperly deserializes untrusted input. The vulnerability requires an authenticated attacker with Administrator-level access to trigger, and it relies on the presence of an additional plugin or theme containing a Property Oriented Programming (POP) chain to achieve meaningful impact.

Successful exploitation of this vulnerability poses a significant risk to the integrity and availability of the WordPress environment. With a CVSS score of 7.2, the flaw is considered high-risk because it can lead to arbitrary file deletion, sensitive data exposure, or remote code execution. This could result in a full site compromise, loss of intellectual property, or significant operational downtime for educational platforms relying on the plugin.

Immediate Action: Update the Academy LMS – WordPress LMS Plugin for Complete eLearning Solution to version 3.3.9 or later, as provided in the vendor patch.

Proactive Monitoring: Monitor server logs for suspicious PHP error patterns or unauthorized attempts to access the import_all_courses functionality.

Compensating Controls: Ensure that only trusted personnel are granted Administrator privileges within the WordPress dashboard, and implement a Web Application Firewall (WAF) to block suspicious serialized object payloads.

Public Exploit Available: No (exploit_available: false)

Given the potential for complete system compromise, administrators should prioritize updating the Academy LMS plugin immediately. Even if the current environment lacks a known POP chain, removing vulnerable code is a critical security best practice to prevent future exploitation if other plugins are added to the site.