MasterStudy LMS Pro CVE-2026-8653

Exploitation requires an authenticated WordPress session with instructor-level role or higher on the target site - PR:L in the CVSS vector confirms low-privilege authentication is the minimum bar. The vulnerable parameter ('columns') is present across all versions up to 4.8.20 with no special non-default configuration required beyond the plugin being installed and active. Limiting factors include: the attacker must hold a valid instructor (or admin/editor) account, meaning unauthenticated or subscriber-level users cannot trigger this; the site must have the MasterStudy LMS Pro Plus plugin installed and activated; and the specific endpoint accepting the 'columns' parameter must be reachable by the attacker's session. There is no requirement for a specific LMS course configuration or feature flag - the vulnerability exists in the plugin's general query handling.

The CVSS 3.1 base score of 6.5 (Medium) is driven by AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The network-accessible, low-complexity, no-user-interaction vector indicates this is straightforward to exploit once authenticated - but PR:L confirms that at least low-privilege authenticated access (instructor role or higher) is required, which meaningfully limits the attack surface compared to unauthenticated vulnerabilities. The confidentiality impact is rated High with no integrity or availability impact, meaning this is a data-exfiltration vector, not a site-takeover vector at face value. However, full database read access via SQL injection can expose WordPress salted password hashes, user PII, and plugin configuration secrets, which could facilitate privilege escalation as a secondary step. No EPSS score was provided in the input data, and there is no CISA KEV listing and no known public exploit code, suggesting opportunistic mass exploitation is not currently occurring. For organizations running open instructor enrollment or multi-tenant LMS deployments where instructors are externally registered users rather than trusted staff, the effective risk is elevated beyond what the medium CVSS score implies.

An attacker registers or compromises an instructor-level account on a target WordPress site running MasterStudy LMS Pro Plus 4.8.20 or earlier, then crafts an authenticated HTTP request to the affected endpoint with a malicious 'columns' parameter value containing appended SQL - such as a UNION SELECT statement - to retrieve rows from arbitrary database tables including wp_users. No public exploit code has been identified at time of analysis, but the low complexity rating and well-understood nature of CWE-89 mean a competent attacker could construct a working payload from the public description alone using standard SQL injection tooling.