MasterStudy LMS EUVD-2026-68064

Exploitation requires that the target WordPress site has open user self-registration enabled (the default WordPress setting 'Anyone can register' must be active, or MasterStudy's own registration must be accessible). The attacker must be able to deliver a crafted registration URL to a target user - typically via email, social media, or course invitation links - and the target user must follow and complete the registration flow (UI:R). Exploitation is limited by: (1) requirement for user interaction - the victim must click and complete registration via the attacker-supplied URL; (2) sites with closed or invite-only registration are not exploitable through this vector; (3) authentication is not required from the attacker's side (PR:N), making the attack feasible from any network position. No special server-side configuration beyond open registration is required.

The CVSS 3.1 base score of 4.7 with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L reflects an accurate characterization: network-reachable, trivially exploitable, requiring no authentication, but dependent on a real user completing registration via a crafted URL (UI:R). The changed scope (S:C) captures the cross-site redirect consequence. The EPSS score of 0.14% at the 3rd percentile is notably low, signaling that automated mass exploitation has not materialized despite a publicly available POC - this is consistent with the social-engineering nature of open redirects, which require targeted lure delivery rather than blind scanning. No CISA KEV listing confirms no confirmed active exploitation campaigns at time of analysis. Realistic risk is context-dependent: sites running registration-open WordPress LMS instances where users are likely to click registration links from emails or shared course invitations face meaningful phishing exposure; sites with closed or invite-only registration have negligible exposure. No data conflicts exist between the CVSS vector and the description.

An attacker identifies a WordPress site running a vulnerable MasterStudy LMS version with open registration enabled. They craft a course enrollment or registration URL appending a redirect parameter pointing to a lookalike login page they control, then distribute the link via email or course-sharing platforms. When a student clicks the link, completes registration, and is immediately redirected to the attacker's phishing page - which mimics the LMS login - they enter credentials that are harvested. A public POC is available from WPScan confirming the technique is documented and reproducible.