The Masteriyo LMS plugin is susceptible to critical insecure deserialization flaws that allow remote code execution, necessitating an immediate update to version 3.4.1 or later.

This vulnerability involves insecure deserialization of user-supplied metadata. Authenticated users with minimal privileges can inject arbitrary PHP objects to execute code on the host, while unauthenticated attackers can leverage a related vector to achieve arbitrary file writes.

The potential for remote code execution poses a catastrophic risk to the integrity, confidentiality, and availability of the entire WordPress environment. Given the high CVSS score of 9.9, an attacker could gain full control over the web server, leading to complete data exfiltration, site defacement, or the deployment of persistent backdoors.

Immediate Action: Update the Masteriyo LMS WordPress plugin to version 3.4.1 or later immediately.

Proactive Monitoring: Review server access logs for suspicious POST requests targeting plugin endpoints and monitor for the creation of unauthorized files in the web root or upload directories.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common PHP object injection patterns and suspicious serialized payloads.

Public Exploit Available: Unknown

The severity of this vulnerability cannot be overstated, as it provides a direct path to server-side compromise. Administrators must prioritize updating the Masteriyo LMS plugin to version 3.4.1 or higher across all production environments immediately to eliminate the underlying deserialization flaw.