User Account Creation Flaw in MasterStudy LMS WordPress Plugin
CVE-2026-88846
Currently unrated
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 24 September 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-88846?
The MasterStudy LMS WordPress Plugin prior to version 3.7.50 has a significant vulnerability where it fails to verify if user registration is enabled on the WordPress site. This oversight permits unauthenticated users to create accounts via the plugin's front-end registration processes, even when the site's registration has been intentionally disabled. Consequently, this could lead to unauthorized access and management of user accounts on affected sites, posing a risk to site integrity and security.
Affected Version(s)
MasterStudy LMS WordPress Plugin 2.3.0 < 3.7.50
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.