vendor:
Masterstudy LMS
by:
Revan Arifio
6.1
CVSS
HIGH
Unauthenticated Instructor Account Creation
287
CWE
Product Name: Masterstudy LMS
Affected Version From: <= 3.0.17
Affected Version To: <= 3.0.17
Patch Exists: YES
Related CWE: CVE-2023-4278
CPE: a:wordpress:masterstudy_lms:3.0.17
Platforms Tested: Windows, Linux
2023
WordPress Plugin Masterstudy LMS – 3.0.17 – Unauthenticated Instructor Account Creation
This exploit allows an attacker to create an unauthenticated instructor account in the Masterstudy LMS Wordpress plugin version 3.0.17 or below. By exploiting this vulnerability, an attacker can gain unauthorized access and perform various actions on the LMS system.
Mitigation:
Update to the latest version of the Masterstudy LMS plugin (3.0.18 or above) or remove the plugin if not needed. Additionally, restrict access to the user-public-account endpoint.
