CVE-2022-0441: MasterStudy LMS WordPress plugin privilege escalation via registration

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated remote privilege escalation to administrator with a CVSS score of 9.8 and very high EPSS probability makes this an urgent patch.

What it is

The MasterStudy LMS WordPress plugin before 2.7.6 fails to validate some parameters supplied during new account registration, letting an unauthenticated user register with administrator privileges. Because the plugin is used on public-facing WordPress sites, any visitor can reach the registration flow and attempt to create an admin account.

Impact

An attacker gains a fully privileged WordPress administrator account, which allows full control of the site, including content, users, plugins and themes. That access can be used to install backdoors, exfiltrate data or repurpose the site.

Attack surface

Reached over the network through the plugin's public registration functionality; no authentication is required and no user interaction is needed per the CVSS vector (AV:N/AC:L/PR:N/UI:N). The flaw is in parameter validation during account creation.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.85334, 99.7th percentile) and the WPScan reference is tagged Exploit, indicating public exploit information exists. No ransomware group usage is documented.

What to do

• Update the MasterStudy LMS plugin to version 2.7.6 or later immediately.
• If patching is not possible, disable or restrict the plugin's public registration feature.
• Audit existing WordPress accounts for unexpected administrator users and remove any that are not authorized.
• Enforce least privilege and review administrator role assignments across the site.
• Monitor plugin advisories and apply vendor updates promptly.

Detection

• Review WordPress user creation logs for new administrator accounts, especially those created outside normal administrative workflows.
• Alert on registration requests that include role or privilege-related parameters.
• Monitor for sudden changes to plugins, themes or site content following new admin account creation.
• Correlate web server logs for registration endpoint access from unusual source IPs or user agents.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.