The MasterStudy LMS WordPress Plugin does not check whether site registration is enabled before creating a user account through its front‑end registration flow, an example of CWE-285 (Broken Access Control) and CWE-862 (Missing Authorization). As a result, an unauthenticated visitor can submit the registration form and receive a logged‑in account, even when the WordPress setting that allows anyone to register has been disabled. The new accounts are created with default WordPress privileges and can be used for spam, enumeration, or future privilege escalation if an administrator promotes the user.

Academic sites and any WordPress installation that has integrated the MasterStudy LMS plugin but is running a version older than 3.7.50. The flaw exists wherever the plugin’s registration pages are reachable; it is not mitigated by other plugins or theme settings.

The vulnerability is a remote issue that can be exploited by interacting with the public registration endpoints. The CVSS score is 5.3, the EPSS score is not available, and the flaw is not listed in the CISA KEV catalog, but because it provides a clear path to unauthorized account creation the risk level is moderate. Attackers could use the newly created accounts to gather information or establish a foothold on the site, especially if the account is later given elevated capabilities.