CVE-2024-2409 is a critical privilege escalation vulnerability in the MasterStudy LMS WordPress plugin for online courses and education. The issue stems from insufficient validation checks in the _register_user() function, invoked by the 'wp_ajax_nopriv_stm_lms_register' AJAX action. This allows unauthenticated attackers to create accounts with administrator-level privileges if both the MasterStudy LMS Pro and LMS Forms Editor add-on are active. The vulnerability affects all versions up to and including 3.3.1. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows unauthenticated attackers to gain administrator-level access to affected WordPress sites running the vulnerable plugin with the specified add-ons. This can lead to full site compromise, including data theft, site defacement, and further malicious activity. The vulnerability impacts confidentiality, integrity, and availability of the affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to disable the MasterStudy LMS Pro and LMS Forms Editor add-on or restrict access to the vulnerable AJAX action if possible. Monitor official stylemix communications for updates and apply patches promptly once available.