CVE-2026-88846: MasterStudy LMS Authentication Bypass Flaw

CVE-2026-88846 Overview

CVE-2026-88846 affects the MasterStudy LMS WordPress plugin in versions prior to 3.7.50. The plugin fails to verify whether user registration is enabled on a site before processing account creation requests through its front-end registration flows. Unauthenticated attackers can create accounts and log into them even when the site administrator has deliberately disabled registration. The flaw is categorized as a missing authorization issue [CWE-862] and stems from a broken access control check in the plugin's registration handlers.

Critical Impact
Unauthenticated attackers can register accounts on sites that have explicitly disabled registration, bypassing an administrator security control and gaining authenticated session access.

Affected Products

MasterStudy LMS WordPress Plugin versions prior to 3.7.50
WordPress sites running MasterStudy LMS with registration disabled
Learning management deployments relying on the plugin's front-end registration flows

Discovery Timeline

2026-09-24 - CVE-2026-88846 published to the National Vulnerability Database
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-88846

Vulnerability Analysis

The MasterStudy LMS plugin exposes multiple front-end registration flows that create WordPress user accounts. These flows invoke account creation logic without consulting the WordPress users_can_register option or any equivalent plugin-level toggle. As a result, the administrator's decision to disable open registration is not enforced for requests reaching the plugin's endpoints.

An attacker sends a crafted HTTP request to the vulnerable registration endpoint. The plugin creates the account, assigns the configured default role, and establishes an authenticated session for the newly created user. The attacker then operates on the site as a logged-in user, inheriting whatever privileges the default role grants.

The issue is tracked as a missing authorization check [CWE-862]. The impact is limited to integrity, since the attacker modifies the user base and gains session access without affecting confidentiality or availability of existing data directly.

Root Cause

The root cause is the absence of a precondition check on the users_can_register setting inside the plugin's front-end registration handlers. Server-side logic trusts that the client only reaches these endpoints when registration is enabled, rather than enforcing the setting at the handler level.

Attack Vector

The attack is remote, unauthenticated, and requires no user interaction. An attacker sends a POST request to the plugin's registration endpoint with the required account fields. The server responds with a created account and an authenticated session, bypassing the administrator's registration-disabled policy.

No verified public exploit code is available. Refer to the WPScan Vulnerability Report for technical specifics.

Detection Methods for CVE-2026-88846

Indicators of Compromise

Unexpected new WordPress user accounts created on sites where users_can_register is set to 0
Account creation events originating from MasterStudy LMS registration endpoints when registration is administratively disabled
Authenticated sessions established immediately after an unauthenticated POST to the plugin's front-end registration handlers

Detection Strategies

Audit the wp_users table for accounts created after the plugin was installed and compare against expected onboarding activity
Review web server logs for POST requests to MasterStudy LMS registration endpoints followed by successful 200 responses on sites with registration disabled
Correlate new user creation events with the WordPress site's registration setting state at the time of creation

Monitoring Recommendations

Enable WordPress audit logging for user_register and session creation events and forward them to a centralized log store
Alert on any user_register event occurring while users_can_register is disabled
Track rate anomalies against the plugin's registration endpoints to identify automated enumeration or mass account creation

How to Mitigate CVE-2026-88846

Immediate Actions Required

Upgrade the MasterStudy LMS WordPress plugin to version 3.7.50 or later on all affected sites
Review and remove any WordPress user accounts created without authorization since the plugin was deployed
Rotate credentials and invalidate active sessions for suspicious accounts
Verify the users_can_register setting and the default new-user role are configured as intended

Patch Information

The vendor fixed the issue in MasterStudy LMS version 3.7.50 by adding a check against the WordPress registration-enabled setting before processing account creation requests. Site administrators should apply the update through the WordPress plugin management interface. See the WPScan Vulnerability Report for advisory details.

Workarounds

Restrict access to the plugin's front-end registration endpoints at the web application firewall or reverse proxy until the patch is applied
Lower the default new-user role to the least-privileged value to limit impact of any unauthorized accounts
Temporarily deactivate the MasterStudy LMS plugin on sites where registration must remain disabled and patching is not immediately possible

bash

# Example WAF rule concept: block unauthenticated POSTs to MasterStudy LMS registration endpoints
# Replace <path> with the specific plugin registration route observed in your deployment
location ~* /wp-content/plugins/masterstudy-lms-learning-management-system/.*register.* {
    if ($request_method = POST) { return 403; }
}