MasterStudy LMS CVE-2026-40766

Requires an authenticated WordPress session at the Subscriber role or higher on a site running MasterStudy LMS ≤ 3.7.25; on sites with open user registration enabled (the default for many LMS deployments to allow self-enrollment) this prerequisite is effectively free for any remote attacker, while sites that disable self-registration limit exploitation to anyone holding or able to obtain a low-tier account. No user interaction by another user is required (UI:N), no special non-default plugin configuration is called out in the advisory, and the network attack vector means exploitation works against any internet-reachable WordPress instance with the plugin installed.

Real-world risk is meaningful but conditional: CVSS 3.1 rates this 8.5 High with AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, meaning network-reachable, low complexity, low privilege required, no user interaction, with high confidentiality impact and low availability impact across a changed scope. The PR:L requirement matches the 'Subscriber' qualifier in the title - WordPress sites that allow open user registration (a common default for LMS sites accepting student signups) effectively expose this to anyone on the internet, while sites with closed registration require an attacker to obtain or create any low-tier account first. There is no CISA KEV listing, no EPSS score provided, and no public exploit identified at time of analysis, but Patchstack-reported SQLi bugs in widely deployed WordPress plugins are historically weaponized quickly once disclosed; treat as a near-term priority for any site running this plugin with open registration. EPSS data is missing from the input and should be checked separately before final prioritization.

An attacker registers a free Subscriber account on a WordPress site running MasterStudy LMS ≤ 3.7.25 (or uses any existing low-privilege account), then sends a crafted authenticated HTTP request to a vulnerable plugin endpoint with SQL syntax in a parameter that is concatenated into a backend query. The injected query exfiltrates sensitive data such as password hashes from wp_users, secret_key values from wp_options, and session tokens, enabling subsequent privilege escalation against the WordPress site or credential reuse elsewhere. No public exploit identified at time of analysis, but the low complexity and Subscriber-only prerequisite make rediscovery straightforward once the advisory is read.