Security Alert Summary
The MasterStudy LMS WordPress Plugin contains a vulnerability that allows unauthenticated users to create accounts through the plugin’s front-end registration flows even when site registration has been deliberately disabled. This can result in unwanted account creation and automatic login on affected sites running vulnerable plugin versions.
CVE Details
- CVE ID:
CVE-2026-88846 - Affected component: MasterStudy LMS WordPress Plugin
- Affected versions: Versions before 3.7.50 (JSON lists version 2.3.0 with < 3.7.50 as affected)
- Published: September 24, 2026 at 6:17:03 AM UTC
- Last modified: September 24, 2026 at 2:42:02 PM UTC
- CVSS v3.1 base score: 5.3 (MEDIUM)
- CVSS v3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Authentication / privileges / user interaction: No authentication required; privileges required: NONE; user interaction: NONE
- Primary impact: Confidentiality: NONE; Integrity: LOW; Availability: NONE
- CWE / weakness: CWE-862
Technical Details
According to the advisory, the plugin does not check whether site-wide user registration is enabled before creating accounts via its front-end registration flows. As a result, unauthenticated users can submit the plugin’s registration flow and cause the plugin to create and log in to new accounts even on sites where the administrator has disabled registration.
The issue exists because the plugin’s front-end registration handlers omit a verification step that should enforce the site registration setting prior to account creation. The available information does not name specific functions or REST endpoints; it explicitly describes the lack of a check for the site registration configuration in the front-end registration flow.
The practical impact is limited to the creation and automatic authentication of new user accounts. The CVSS data indicates integrity impact is low and there is no direct confidentiality or availability impact documented.
How This Could Impact Your Website
On a typical site using MasterStudy LMS, a site owner or administrator may have disabled user registration to control who can create accounts. If the site runs a vulnerable plugin version, an external actor could create accounts without approval. That creates extra user accounts that internal staff must audit and manage.
For example, an external contractor or contributor could create multiple accounts and use them to interact with course content or messaging features. While the vulnerability does not indicate exposure of existing user passwords or direct data exfiltration, the presence of unexpected accounts can expose internal user email addresses (for example, via author lists or messaging), increasing the risk of targeted phishing or social engineering against staff or contributors.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from the site.
- Monitor site activity and newly created accounts for unusual behavior.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
