What’s Vulnerable › Vulnerabilities

CVE-2023-4278: MasterStudy LMS < 3.0.18 - Unauthenticated Instructor Account Creation

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 6.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-09-11 · updated 2026-06-17

Description

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.0.18 does not have proper checks in place during registration allowing anyone to register on the site as an instructor. They can then add courses and/or posts.

Affected products

• MasterStudy LMS WordPress Plugin: before 3.0.18 — fixed in 3.0.18

How to fix

Upgrade to a fixed version: MasterStudy LMS WordPress Plugin 3.0.18. Check the vendor advisory for mitigations.

References

• http://packetstormsecurity.com/files/175007/WordPress-Masterstudy-LMS-3.0.17-Account-Creation.html
• https://wpscan.com/vulnerability/cb3173ec-9891-4bd8-9d05-24fe805b5235
• http://packetstormsecurity.com/files/175007/WordPress-Masterstudy-LMS-3.0.17-Account-Creation.html
• https://wpscan.com/vulnerability/cb3173ec-9891-4bd8-9d05-24fe805b5235

Get alerted when CVE-2023-4278 or the next vulnerability affects your stack