CVE-2022-0441
Published: 07 March 2022
Summary
CVE-2022-0441 is a critical-severity Improper Privilege Management (CWE-269) vulnerability in Stylemixthemes Masterstudy Lms. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The MasterStudy LMS WordPress plugin prior to version 2.7.6 contains an improper privilege management flaw (CWE-269) in its account registration flow. The plugin fails to validate certain parameters supplied during new user creation, which permits an unauthenticated caller to supply an administrative role and thereby create accounts with full administrative privileges. The vulnerability carries a CVSS 3.1 base score of 9.8, reflecting network-accessible exploitation with no required credentials or user interaction.
An unauthenticated attacker can therefore submit a crafted registration request that directly grants administrator rights on the affected WordPress site. Successful exploitation yields complete control over the site, including the ability to install plugins, modify content, and access or alter any data stored by the LMS or other installed components.
Public references point to a corrective changeset committed to the WordPress plugin repository and a detailed advisory published by WPScan. Site operators are advised to update MasterStudy LMS to version 2.7.6 or later, which enforces proper role validation during registration.
The CVE’s EPSS score reached a peak of 0.9387 and remains elevated at 0.8135, indicating substantial and sustained exploitation interest after public disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-15580
Vulnerability details
The MasterStudy LMS WordPress plugin before 2.7.6 does to validate some parameters given when registering a new account, allowing unauthenticated users to register as an admin
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Policy addresses roles, responsibilities, and privilege management to prevent improper privilege assignments.
Access supervision ensures privileges are assigned and managed without improper escalation or retention.
Assigning group/role memberships and access authorizations (privileges) while reviewing accounts addresses improper privilege management.
Enforces proper privilege management by requiring all decisions through the verified reference monitor.
By mandating division of duties across roles, the control enforces proper privilege management and prevents a single entity from controlling an entire sensitive process.
Implements core proper privilege management by restricting to only required rights.
Policy requires training on privilege management and least privilege, making it harder to exploit improper privilege management weaknesses.
Training covers proper privilege management practices, making incorrect privilege assignments less likely.