Masteriyo LMS WordPress Plugin Code Execution Vulnerability

The Masteriyo LMS WordPress plugin, before version 3.4.1, has a security flaw that allows users with minimal accounts to inject and execute arbitrary PHP code on the server.

This is due to the plugin not preventing user-supplied values held as metadata from being deserialized when they are read back. A weaker form of the same issue is reachable without an account and allows an arbitrary file write.