CVE-2026-81342: CWE-601 URL Redirection to Untrusted Site ('Open Redirect') in MasterStudy LMS WordPress Plugin

The MasterStudy LMS WordPress Plugin versions prior to 3.7.43 contain a CWE-601 open redirect vulnerability. Specifically, the plugin fails to validate a redirect parameter during the user registration process. This flaw allows unauthenticated attackers to craft URLs that redirect users to arbitrary external sites, potentially facilitating phishing or other social engineering attacks. The CVSS v3.1 base score is 4.7 (medium), with attack vector network, low attack complexity, no privileges required, user interaction required, scope changed, and limited confidentiality impact. No official patch or remediation guidance is currently available from the vendor or public advisories.

An attacker can exploit this vulnerability to redirect users to malicious external websites by manipulating the redirect parameter during registration. This can be used for phishing or to trick users into visiting harmful sites. The vulnerability does not directly impact confidentiality, integrity, or availability of the plugin or its data but poses a risk of user deception.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling user registration or implementing additional validation on redirect parameters via custom code or security plugins to prevent open redirects.