CVE-2023-4278

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

The MasterStudy LMS WordPress plugin before version 3.0.18 contains a missing authorization check during user registration that permits any unauthenticated visitor to create an account with the instructor role. The affected component is the registration workflow in this learning-management-system plugin for WordPress, which subsequently grants the newly created account the ability to publish courses and posts.

An attacker can exploit the flaw over the network without authentication or user interaction, achieving high-integrity impact by adding arbitrary course content or posts to the site. The CVSS 3.1 score of 7.5 reflects the combination of network accessibility, low attack complexity, and absence of required privileges.

Public references on WPScan and Packet Storm document the issue and include proof-of-concept material showing account creation, but do not detail additional mitigations beyond upgrading to 3.0.18 or later. The EPSS score has remained near 0.21–0.22 with no material rise after disclosure.