# CVE-2022-0441: MasterStudy LMS WordPress plugin - Privilege Escalation

> Live exploitation tracking for CVE-2022-0441 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2022-0441

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** StylemixThemes MasterStudy LMS WordPress plugin
- **Weaknesses:** CWE-269 (Improper Privilege Management)
- **Tags:** wordpress, cms

## Description

The MasterStudy LMS WordPress plugin before 2.7.6 does to validate some parameters given when registering a new account, allowing unauthenticated users to register as an admin

## CrowdSec analysis

[CVE-2022-0441](https://euvd.enisa.europa.eu/vulnerability/CVE-2022-0441) is a critical privilege escalation vulnerability in the MasterStudy LMS WordPress plugin prior to version 2.7.6, where improper validation during account registration allows unauthenticated users to create admin accounts. This flaw could enable attackers to gain full administrative control over affected WordPress sites, leading to potential site takeover and further exploitation.

CrowdSec has been tracking this vulnerability and its exploits since 11th of February 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2022-0441 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit the `/wp-admin/admin-ajax.php` endpoint with the `action=stm_lms_register` parameter to register new accounts with elevated administrator privileges by manipulating the `profile_default_fields_for_register` field.

## Timeline

- 2022-03-07: CVE Published. CVE-2022-0441 is published to NVD.
- 2026-02-11: Rule Released. CrowdSec releases a rule to detect CVE-2022-0441 exploitation attempts against the CrowdSec Network.
- 2026-04-10: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2022-0441 for the first time.

## References

- https://wpscan.com/vulnerability/173c2efe-ee9c-4539-852f-c242b4f728ed
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0441.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2022-0441) follows observed exploitation activity for CVE-2022-0441. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.