CVE-2026-88846 in MasterStudy LMS Plugin
Summary
by MITRE • 09/24/2026
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not check whether user registration is enabled on the site before creating an account through one of its front-end registration flows, allowing unauthenticated users to create accounts, and be logged into them, on sites where registration has been deliberately disabled.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/24/2026
The vulnerability identified in MasterStudy LMS WordPress Plugin versions prior to 3.7.50 represents a critical authentication bypass flaw rooted in insufficient input validation regarding site configuration states. Specifically, the plugin fails to verify whether user registration is enabled via the global WordPress settings before executing account creation logic through its front-end registration interfaces. This oversight allows unauthenticated actors to successfully register new accounts and subsequently log into them on websites where administrators have explicitly disabled public registration. The core technical flaw lies in the absence of a conditional check against the wp_registration option or equivalent configuration flags that dictate whether user self-registration is permitted by the site administrator. By bypassing this gatekeeping mechanism, the plugin effectively ignores administrative intent to restrict access, thereby creating unauthorized entry points into protected learning management system environments.
From an operational perspective, this vulnerability enables unauthenticated attackers to establish persistent identities within the application without any prior credentials or approval processes. Once these accounts are created and authenticated, attackers gain a foothold that can be leveraged for various malicious activities depending on the assigned user roles. In many WordPress configurations, newly registered users may automatically receive subscriber-level privileges, which might include access to course materials, discussion forums, or personal data fields. If the site allows role escalation through other vulnerabilities or misconfigurations, these accounts could serve as a springboard for privilege escalation attacks. Furthermore, the ability to create arbitrary accounts facilitates spamming activities, such as posting malicious comments, filling out forms with phishing links, or consuming server resources through automated requests, thereby impacting the availability and integrity of the service for legitimate users.
This flaw aligns closely with Common Weakness Enumeration (CWE) category CWE-287, which describes Improper Authentication, specifically falling under scenarios where authentication bypass occurs due to missing checks on authorization policies or configuration states. It also relates to CWE-601, URL Redirection to Untrusted Site in the context of potential phishing if registration redirects are manipulated, though the primary issue is the lack of access control enforcement based on site settings. In terms of the MITRE ATT&CK framework for enterprise security, this vulnerability supports techniques associated with Initial Access and Account Manipulation. Attackers can utilize these forged accounts to maintain persistence within the system or as a vector for further lateral movement if additional vulnerabilities exist in the plugin’s subsequent features such as grade manipulation or content editing capabilities that might be exposed to lower-privileged users.
Mitigation strategies must prioritize immediate patching of the MasterStudy LMS WordPress Plugin to version 3.7.50 or later, where this validation logic has been corrected to respect the global registration settings. Administrators should also implement defense-in-depth measures by restricting access to the wp-admin and plugin-specific endpoints using web application firewalls that can detect anomalous registration patterns from untrusted sources. Additionally, reviewing user roles assigned upon registration is crucial; ensuring that new accounts do not inherit excessive privileges reduces the impact of any successful exploitation. Regular security audits focusing on authentication flows across all plugins are recommended to identify similar oversights where configuration states are ignored during critical operations like account creation or password resets.