The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.43 does not validate a redirect parameter supplied during user registration before… (CVE-2026-81342)

The MasterStudy LMS WordPress plugin prior to version 3.7.43 does not properly validate a redirect parameter during the user registration process. This lack of validation enables unauthenticated attackers to craft URLs that redirect users to arbitrary external sites after registration. The vulnerability is classified as an open redirect (CWE-601) and has a CVSS 3.1 base score of 4.7, indicating a medium severity level. There are no known exploits in the wild reported at this time. No official patch or remediation link is provided in the available data.

An attacker can exploit this vulnerability to redirect users to malicious external websites after registration, which could be used for phishing or other social engineering attacks. The vulnerability does not directly impact confidentiality, integrity, or availability of the plugin or underlying system but poses a risk to user trust and security due to potential redirection to harmful sites.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with URLs involving user registration redirects. Monitoring for updates from the plugin vendor is recommended to apply any forthcoming patches promptly.