All vulnerabilities
CVE-2026-88846

MasterStudy LMS 2.3.0 - < 3.7.50 - Unauthenticated Account Creation with Registration Disabled

Unknown MasterStudy LMS WordPress PluginApplications & CMS
Open in ThreatlineRecord JSON
CVSS
5.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 7% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.7.50Fixed versionCVE List
Published24 Sep 2026Updated 24 Sep 2026CVE List

What fixes it

  • 3.7.50MasterStudy LMS WordPress PluginCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not check whether user registration is enabled on the site before creating an account through one of its front-end registration flows, allowing unauthenticated users to create accounts, and be logged into them, on sites where registration has been deliberately disabled.

Text from CVE List

Affected versions 1

  • MasterStudy LMS WordPress Pluginaffected: 2.3.0 before 3.7.50CVE List

References 1