Threats tagged 'ghsa-6gj4-3cmf-ffjv'

The Academy LMS WordPress plugin up to version 3.3.8 is vulnerable to PHP Object Injection via deserialization of untrusted input in the 'import_all_courses' function. This vulnerability requires authenticated Administrator-level access and depends on the presence of a gadget POP chain in other installed plugins or themes to be exploitable. Without such a POP chain, the vulnerability has no impact. If a POP chain exists, attackers could potentially delete files, access sensitive data, or execute arbitrary code.