WordPress Plugin Vulnerabilities

MasterStudy LMS 2.3.0 - < 3.7.50 - Unauthenticated Account Creation with Registration Disabled

Description

The plugin does not check whether user registration is enabled on the site before creating an account through one of its front-end registration flows, allowing unauthenticated users to create accounts, and be logged into them, on sites where registration has been deliberately disabled.

Proof of Concept

Affects Plugins

Plugin icon
masterstudy-lms-learning-management-system
Fixed in 3.7.50

References

CVE
CVE-2026-88846

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
vuxvinh
Submitter
vuxvinh
Verified
Yes
WPVDB ID
57b0dd3f-bd83-4fb7-b98d-c999026910cd

Timeline

Publicly Published
2026-09-22 (about 2 days ago)
Added
2026-09-22 (about 1 day ago)
Last Updated
2026-09-22 (about 1 day ago)

Other

Published
Title
Published
2026-05-24
Title
Quads Ads Manager for Google AdSense < 3.0.3 - Missing Authorization
Published
2026-04-29
Title
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) < 4.1.9 - Missing Authorization
Published
2026-06-17
Title
Five Star Restaurant Reservations – WordPress Booking Plugin < 2.7.20 - Missing Authorization
Published
2024-02-26
Title
Thank You Page Customizer for WooCommerce – Increase Your Sales < 1.1.3 - Missing Authorization to Authenticated (Subscriber+) Data Export
Published
2025-01-16
Title
WP Journal <= 1.1 - Missing Authorization