CVE-2023-4278 MasterStudy LMS < 3.0.18 - Unauthenticated Instructor Account Creation

What is CVE-2023-4278?

CVE-2023-4278 is a high-severity missing authorization vulnerability in Unknown MasterStudy LMS WordPress Plugin, published on 11 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.0.18 does not have proper checks in place during registration allowing anyone to register on the site as an instructor. They can then add courses and/or posts.

Which versions are affected by CVE-2023-4278?

It affects 1 product.

Products include Stylemixthemes Masterstudy Lms.

How do I fix CVE-2023-4278?

No fix has been published for CVE-2023-4278 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2023-4278 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-4278 exists.

Public exploit code: 1 Exploit-DB entry and 1 proofs of concept on GitHub.

Other vulnerabilities in Unknown MasterStudy LMS WordPress Plugin

• CVE-2024-3136 MasterStudy LMS <= 3.3.3 - Unauthenticated Local File Inclusion via template Critical 9.8
• CVE-2024-2409 MasterStudy LMS <= 3.3.1 - Unauthenticated Privilege Escalation via stm_lms_register AJAX Action Critical 9.8
• CVE-2024-2411 MasterStudy LMS <= 3.3.0 - Unauthenticated Local File Inclusion via modal Critical 9.8
• CVE-2024-1512 MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.5 - Unauthenticated SQL Injection Critical 9.8
• CVE-2022-0441 MasterStudy LMS < 2.7.6 - Unauthenticated Admin Account Creation Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-522j-v5mv-h6mw.