{"cve":{"cve_id":"CVE-2023-4278","is_kev":false,"kev_date_added":null,"kev_vendor_project":null,"kev_product":null,"kev_vulnerability_name":null,"kev_short_description":null,"kev_required_action":null,"kev_due_date":null,"kev_known_ransomware":null,"kev_notes":null,"kev_cwes":null,"epss_score":0.06235,"epss_percentile":0.93152,"epss_as_of":"2026-09-15","description":"The MasterStudy LMS WordPress Plugin WordPress plugin before 3.0.18 does not have proper checks in place during registration allowing anyone to register on the site as an instructor. They can then add courses and/or posts.","published_at":"2023-09-11T19:46:08.650000Z","last_modified_at":null,"cvss_v3_score":7.5,"cvss_v3_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cvss_v3_severity":"HIGH","cvss_v4_score":null,"cvss_v4_vector":null,"cvss_v4_severity":null,"ssvc_decision":null,"ssvc_exploitation":"poc","ssvc_automatable":true,"ssvc_technical_impact":"partial","cwes":null,"nvd_references":["https://wpscan.com/vulnerability/cb3173ec-9891-4bd8-9d05-24fe805b5235","http://packetstormsecurity.com/files/175007/WordPress-Masterstudy-LMS-3.0.17-Account-Creation.html"],"vuln_status":null,"trending_score":null,"is_trending":false,"has_trended":false,"trended_number_one":false,"trending_peak_score":null,"trending_peak_rank":null,"started_trending_at":null,"trended_number_one_at":null,"summary_generated":null,"summary_generated_at":null,"summary_model":null,"created_at":"2026-06-24T00:09:39.878444Z","updated_at":"2026-06-29T01:41:16.128405Z"},"effective_severity":"HIGH","badges":["exploit"],"impact_analysis":[],"cvss_v3_decoded":{"version":"3.1","metrics":[{"metric":"AV","name":"Attack Vector","value":"N","value_label":"Network"},{"metric":"AC","name":"Attack Complexity","value":"L","value_label":"Low"},{"metric":"PR","name":"Privileges Required","value":"N","value_label":"None"},{"metric":"UI","name":"User Interaction","value":"N","value_label":"None"},{"metric":"S","name":"Scope","value":"U","value_label":"Unchanged"},{"metric":"C","name":"Confidentiality","value":"N","value_label":"None"},{"metric":"I","name":"Integrity","value":"H","value_label":"High"},{"metric":"A","name":"Availability","value":"N","value_label":"None"}]},"cvss_v4_decoded":{"version":null,"metrics":[]},"affected":[{"vendor_slug":"unknown","vendor_name":"Unknown","product_slug":"masterstudy-lms-wordpress-plugin","product_name":"MasterStudy LMS WordPress Plugin","version_start":"0","version_start_inclusive":true,"version_end":"3.0.18","version_end_inclusive":false,"cpe23_uri":"cve5:unknown:masterstudy-lms-wordpress-plugin:0:3.0.18"}],"exploit_refs":[{"source":"exploit-db","kind":"exploit-db","url":"https://www.exploit-db.com/exploits/51735","title":"Wordpress Plugin Masterstudy LMS - 3.0.17 - Unauthenticated Instructor Account Creation","author":"Revan Arifio","disclosed_at":"2023-10-09"}],"news":[],"references":[{"url":"https://wpscan.com/vulnerability/cb3173ec-9891-4bd8-9d05-24fe805b5235","source_type":"MISC","tags":[]},{"url":"http://packetstormsecurity.com/files/175007/WordPress-Masterstudy-LMS-3.0.17-Account-Creation.html","source_type":"EXPLOIT","tags":["exploit"]}],"timeline":[{"type":"published","at":"2023-09-11T19:46:08.650000Z","label":"CVE published","source":null},{"type":"exploit_known","at":"2023-10-09T00:00:00Z","label":"Public exploit available","source":"exploit-db"},{"type":"cvss_changed","at":"2026-06-28T17:30:48.906316Z","label":"CVSS score revised","source":"cvelistv5"},{"type":"cvss_changed","at":"2026-06-28T17:30:48.906316Z","label":"CVSS score revised","source":"cvelistv5"},{"type":"cvss_changed","at":"2026-06-28T17:30:48.906316Z","label":"CVSS score revised","source":"cvelistv5"},{"type":"ssvc_changed","at":"2026-06-29T01:41:16.128405Z","label":"SSVC decision revised","source":"vulnrichment"},{"type":"ssvc_changed","at":"2026-06-29T01:41:16.128405Z","label":"SSVC decision revised","source":"vulnrichment"},{"type":"ssvc_changed","at":"2026-06-29T01:41:16.128405Z","label":"SSVC decision revised","source":"vulnrichment"}]}