MasterStudy LMS < 3.0.18 - Unauthenticated Instructor Account Creation
41Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 7.5epss 3.5%
from disclosure to weapon0 days
Published on NVDSep 11
1st PoCSep 4
exploitation probability
3.5%top 12% of all CVEs
observed exploitation
nono source reports it
4 public exploit(s)
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.0.18 does not have proper checks in place during registration allowing anyone to register on the site as an instructor. They can then add courses and/or posts.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected products
Unknown · MasterStudy LMS WordPress Pluginpublic PoCs found — 4
exploitdbwww.exploit-db.com/exploits/51735unverifiedgithubgithub.com/revan-ar/CVE-2023-4278★ 0cve_referencepacketstormsecurity.com/files/175007/WordPress-Masterstudy-LMS-3.0.17-Account-Creation.htmlunverifiedcve_referencewpscan.com/vulnerability/cb3173ec-9891-4bd8-9d05-24fe805b5235unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.