Stylemix MasterStudy LMS: PHP Object Injection by Subscriber users
Summary
MasterStudy LMS, a WordPress plugin for online courses, is affected by a PHP Object Injection flaw (CWE-502) in versions up to and including 3.7.55. An attacker with a low-privilege Subscriber account can send crafted data that the site unserializes, which may allow manipulation of server-side processing and, depending on the classes present in the WordPress installation, harmful actions on the server. Exploitation requires network access and a Subscriber account, but no user interaction. The patched version is 3.7.56.
Affected
- MasterStudy LMS WordPress plugin, versions up to and including 3.7.55
- Attack requires a Subscriber-level account
Fixed in
- Update to version 3.7.56 or later (CNA Patchstack and CISA SSVC data)
- Note: the 3.7.56 changelog mentions a PHP Object Injection fix in the LearnPress migration tool. The vendor has not explicitly linked this to CVE-2026-118090 in the sources reviewed.
Workaround
Unknown. No vendor workaround is documented.
- Until the update is applied, disable or restrict public student and subscriber registration.
- Review which accounts hold the Subscriber role and remove unneeded ones.
- These measures are our recommendation, not vendor guidance.
Exploitation
- No public exploit according to VulDB, although its later text states exploitation is known to be easy (sources differ).
- Not known to be exploited according to OffSeq; Strix lists it as not in KEV.
- CISA SSVC in the CNA record: exploitation none, not automatable.
- Patchstack describes the flaw as high priority and expected to be exploited.
Our recommendation
- Identify all WordPress sites running MasterStudy LMS version 3.7.55 or earlier.
- Update to version 3.7.56 or later and confirm the installed version in production.
- Restrict or review subscriber self-registration until the update is applied.
- Monitor web server and application logs for unusual requests to the LMS plugin.
- Check the other recent MasterStudy LMS fixes listed in the sources, as older versions miss several of them.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory: MasterStudy LMS PHP Object Injection patchstack.com
- WordPress.org plugin page and changelog wordpress.org
- VulDB entry 429299 vuldb.com
- Positive Technologies PT-2026-133766 (Vulners) vulners.com
- OffSeq radar entry for CVE-2026-118090 radar.offseq.com
- Strix CVE entry CVE-2026-118090 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 08:42.
Original description (NVD)
Subscriber PHP Object Injection in MasterStudy LMS <= 3.7.55 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.