MasterStudy LMS < 3.3.2 - Unauthenticated Privilege Escalation

Description

The plugin is vulnerable to Privilege Escalation due to insufficient validation checks within the _register_user() function called by the 'wp_ajax_nopriv_stm_lms_register' AJAX action. This makes it possible for unauthenticated attackers to register a user with administrator-level privileges when MasterStudy LMS Pro is installed and the LMS Forms Editor add-on is enabled.