High severity · published Sep 11, 2023
CVE-2023-4278
MasterStudy LMS < 3.0.18 - Unauthenticated Instructor Account Creation
7.5
CVSS
6.2%
EPSS
No
On KEV
Description
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.0.18 does not have proper checks in place during registration allowing anyone to register on the site as an instructor. They can then add courses and/or posts.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)6.2% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ML
MasterStudy LMS WordPress Plugin ·
before 3.0.18 · source: vendor
ML
Masterstudy Lms · Stylemixthemes
before 3.0.18 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-4278
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-4278
packetstormsecurity.com
http://packetstormsecurity.com/files/175007/WordPress-Masterstudy-LMS-3.0.17-Account-Creation.html
Exploit
https://wpscan.com/vulnerability/cb3173ec-9891-4bd8-9d05-24fe805b5235
More from MasterStudy LMS WordPress Plugin
8.8
CVE-2024-5973
MasterStudy LMS < 3.3.24 - Privilege Escalation to Instructor
7.2
CVE-2026-88843
MasterStudy LMS 3.5.29 - < 3.7.50 - Contributor+ LFI via Elementor Courses Categories Widget
5.3
CVE-2026-88846
MasterStudy LMS 2.3.0 - < 3.7.50 - Unauthenticated Account Creation with Registration Disabled
5.3
CVE-2026-81199
MasterStudy LMS < 3.7.46 - Unauthenticated Student Statistics Disclosure via student/stats REST Route
5.3
CVE-2026-81197
MasterStudy LMS < 3.7.46 - Unauthenticated Unpublished Course Title Disclosure via course-list REST Route