EUVD-2026-34191
GHSA-xcv3-99jh-m22g
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The MasterStudy LMS Pro Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'columns' parameter in all versions up to, and including, 4.8.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with instructor-level access or above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
AnalysisAI
SQL injection in MasterStudy LMS Pro Plus for WordPress exposes database contents to authenticated instructors through the unsanitized 'columns' parameter, affecting all versions up to and including 4.8.20. The vulnerability stems from insufficient input escaping and absent parameterized query preparation, enabling authenticated attackers with at minimum instructor-level access to append arbitrary SQL to existing queries and extract sensitive data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and high confidentiality impact make this a meaningful risk for multi-tenant LMS deployments where instructors are semi-trusted external parties.
Technical ContextAI
The affected product is the MasterStudy LMS Pro Plus WordPress plugin by StylemixThemes, identified via CPE cpe:2.3:a:stylemixthemes:masterstudy_lms_pro:*:*:*:*:*:*:*:*. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), a classic SQL injection class arising when user-supplied input - in this case the 'columns' parameter - is interpolated directly into SQL queries without adequate escaping or use of prepared statements with bound parameters. WordPress plugins frequently interact with the WordPress wpdb abstraction layer; when developers bypass $wpdb->prepare() or use it incorrectly, raw input reaches the database query string. The 'columns' parameter likely controls dynamic column selection in reporting or data-listing functionality common in LMS platforms, making it a non-obvious injection surface compared to standard search or ID fields.
RemediationAI
No explicit patched version number was included in the provided intelligence data; site operators should immediately check the WordPress plugin repository or the StylemixThemes vendor page at https://stylemixthemes.com/wordpress-lms-plugin/ for an updated release above 4.8.20 and apply it as the primary remediation. Until a confirmed patched version is applied, compensating controls include: restricting instructor account creation to vetted, trusted users only and auditing existing instructor accounts for unexpected registrations; enabling a WordPress web application firewall (such as the Wordfence firewall) with SQL injection rules to intercept malformed 'columns' parameter payloads - note this adds latency and may have false-positive risk on legitimate requests; and reviewing WordPress database user permissions to ensure the MySQL user used by WordPress operates under least-privilege (SELECT only where write is not needed), limiting the blast radius of successful injection. Monitoring database query logs for anomalous UNION, INFORMATION_SCHEMA, or multi-statement patterns targeting the affected plugin's tables is also advisable as a detection measure.
More in Masterstudy Lms Pro
View allSame weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today