The MasterStudy LMS WordPress plugin before version 3.7.43 contains an open redirect flaw. During user registration the plugin accepts a redirect parameter and uses it blindly in an HTTP redirect response. An attacker who can trigger the registration flow – which does not require authentication – can supply any external URL in that parameter and cause browsers to navigate users to arbitrary sites, enabling phishing, credential theft, or delivery of malware.

The vulnerability affects installations of the MasterStudy LMS WordPress plugin with a version earlier than 3.7.43. The plugin is distributed for WordPress sites and can be found under the vendor name Unknown:MasterStudy LMS WordPress Plugin.

The exploit requires no privileged access and can be performed by any external user who can access the registration page. No EPSS score is published and the vulnerability is not listed in the CISA KEV catalog, but the lack of any validation on the redirect parameter provides a common attack vector used by threat actors. With as little as a single crafted link to a redirect-enabled registration page, an attacker can lead unsuspecting users to malicious sites.