CVE-2023-4278: high-severity vulnerability in MasterStudy LMS WordPress Plugin
MasterStudy LMS < 3.0.18 - Unauthenticated Instructor Account Creation
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
41Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 7.5epss 6.2%
from disclosure to weaponsame day
Published on NVDSep 11
1st PoCSep 4
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.0.18 does not have proper checks in place during registration allowing anyone to register on the site as an instructor. They can then add courses and/or posts.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected products
Unknown · MasterStudy LMS WordPress Pluginpublic PoCs found — 4
exploitdbwww.exploit-db.com/exploits/51735unverifiedgithubgithub.com/revan-ar/CVE-2023-4278★ 0cve_referencewpscan.com/vulnerability/cb3173ec-9891-4bd8-9d05-24fe805b5235unverifiedcve_referencepacketstormsecurity.com/files/175007/WordPress-Masterstudy-LMS-3.0.17-Account-Creation.htmlunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — MasterStudy LMS WordPress Plugin
In the same product, most dangerous first.
CVE-2024-5973CRITICALMasterStudy LMS < 3.3.24 - Privilege Escalation to InstructorEPSS 0.5%CVE-2026-81199MEDIUMMasterStudy LMS < 3.7.46 - Unauthenticated Student Statistics Disclosure via student/stats REST RouteEPSS 0.5%CVE-2026-88843HIGHMasterStudy LMS 3.5.29 - < 3.7.50 - Contributor+ LFI via Elementor Courses Categories WidgetEPSS 0.4%CVE-2026-81197MEDIUMMasterStudy LMS < 3.7.46 - Unauthenticated Unpublished Course Title Disclosure via course-list REST RouteEPSS 0.3%CVE-2026-81195MEDIUMMasterStudy LMS < 3.7.46 - Unauthenticated Student Enrollment Disclosure via student-courses REST RouteEPSS 0.3%CVE-2026-81340LOWMasterStudy LMS < 3.7.50 - Instructor+ Order Status Manipulation via IDOREPSS 0.3%