MasterStudy LMS CVE-2026-88846

Requires the MasterStudy LMS plugin (versions 2.3.0 through before 3.7.50) installed and active, and - critically - the site administrator must have deliberately DISABLED user registration; on sites where registration is left enabled the behavior grants nothing beyond intended self-registration, so there is no security consequence. No authentication, no user interaction, and no special platform configuration is otherwise needed: exploitation is via the plugin's unauthenticated front-end registration flow. The limiting factor is therefore the site's registration-disabled configuration, which defines where the flaw actually matters; impact is capped at subscriber-level account creation (I:L), with no confidentiality or availability effect.

This is a genuine but low-to-moderate priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N = 5.3) is internally consistent with the description: remote, unauthenticated, no user interaction, and impact limited to integrity (I:L) with no confidentiality or availability effect. The only impact is bypassing a deliberately-configured control - the plugin fails to honor the site's 'registration disabled' setting, letting anyone self-register and log in. SSVC confirms this profile: Exploitation 'none' (no observed active exploitation), Automatable 'yes' (a scriptable unauthenticated HTTP flow), Technical Impact 'partial'. A public POC exists (WPScan) and a vendor patch is available (3.7.50), but there is no EPSS score and no CISA KEV listing, so there is no evidence of active or widespread exploitation. Signals align rather than conflict: high CVSS reach (unauth/network) but modest real impact (unauthorized account creation at subscriber level only, which the site would otherwise have granted had registration been left on). Net: worth patching promptly on sites that intentionally disabled registration, but not an emergency; the 'partial' technical impact and absence of KEV/EPSS argue against panic. Note the CPE vendor is recorded as 'unknown' - the real vendor is StyleMixThemes.

An attacker targets a WordPress site running MasterStudy LMS where the administrator has deliberately turned off open registration. Using the plugin's front-end registration endpoint, the attacker submits a registration request; because the plugin never checks the site's registration-enabled setting, an account is created and the attacker is automatically logged in. A public exploit is available via WPScan, and because the flow is unauthenticated and scriptable (SSVC Automatable: yes), it can be automated to mass-create accounts.