Critical Alert 4 Active Exploits Detected Today

CVE-2026-84869 ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability →
CVE-2026-42016 JFrog Artifactory Incorrect Authorization Vulnerability →
CVE-2026-42018 JFrog Artifactory Improper Authentication Vulnerability →
CVE-2026-85706 GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability →
Powered by CVE Watchtower
×

CVE Watchtower


← Back to CVE List

CVE-2026-82845NVD

Vulnerability Summary

The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowing users with a minimal account to inject arbitrary PHP objects and, by way of a class shipped in a library bundled with the Masteriyo LMS WordPress plugin before 3.4.1, write and execute arbitrary code on the server. A weaker form of the same issue is reachable without an account and yields an arbitrary file write rather than code execution.
Severity Level
CRITICAL(9.9)
Published Date
Sep 12, 2026
Last Modified
Sep 12, 2026
Exploitation Status
No confirmed exploitation yet
EPSS Score (30-Day)
0.17%Probability
Root Weakness (CWE)
Refer to the official MITRE database for detailed architectural specifications regarding this weakness.
CVSS v3.1 Base Metrics
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
ScopeChanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh