Critical · published March 29, 2024
🚨 An unauthenticated attacker can register as an admin in WordPress with the MasterStudy LMS plugin — that's like letting anyone stroll into a secure building with a VIP badge! 🔥 Think of this vulnerability like a hotel reception that skips verifying guest IDs. Anyone could walk up, claim to be an important guest, and get access to the penthouse suite without anyone batting an eye! An attacker could exploit this flaw to gain full control over your WordPress site, potentially deleting important data, modifying content, or even taking down your entire site. With admin privileges at their fingertips, they could do almost anything, and you wouldn't even know until it's too late!
Think of this vulnerability like a hotel reception that skips verifying guest IDs. Anyone could walk up, claim to be an important guest, and get access to the penthouse suite without anyone batting an eye! This privilege escalation vulnerability exists due to insufficient validation checks in the _register_user() function used in the 'wp_ajax_nopriv_stm_lms_register' AJAX action, allowing unauthenticated users to register as administrators.
An attacker could exploit this flaw to gain full control over your WordPress site, potentially deleting important data, modifying content, or even taking down your entire site. With admin privileges at their fingertips, they could do almost anything, and you wouldn't even know until it's too late! Immediately update the MasterStudy LMS plugin to version 3.3.2 or later. If you're using the LMS Forms Editor add-on, consider disabling it until you can apply the patch. Regularly monitor your user registrations to ensure no unauthorized accounts have been created. You've got this! With these steps, you can lock down your WordPress site and keep those rogue admins at bay. 🛡️