What is the CVSS score of EUVD-2026-34191?

EUVD-2026-34191 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

MasterStudy LMS Pro EUVD-2026-34191

| CVE-2026-8653 MEDIUM

SQL Injection (CWE-89)

2026-06-04 Wordfence

GHSA-xcv3-99jh-m22g

SQLi WordPress

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 04, 2026 - 01:57 vuln.today

CVE Published

Jun 04, 2026 - 01:26 nvd

MEDIUM 6.5

DescriptionCVE.org

The MasterStudy LMS Pro Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'columns' parameter in all versions up to, and including, 4.8.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with instructor-level access or above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

SQL injection in MasterStudy LMS Pro Plus for WordPress exposes database contents to authenticated instructors through the unsanitized 'columns' parameter, affecting all versions up to and including 4.8.20. The vulnerability stems from insufficient input escaping and absent parameterized query preparation, enabling authenticated attackers with at minimum instructor-level access to append arbitrary SQL to existing queries and extract sensitive data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and high confidentiality impact make this a meaningful risk for multi-tenant LMS deployments where instructors are semi-trusted external parties.

Technical ContextAI

The affected product is the MasterStudy LMS Pro Plus WordPress plugin by StylemixThemes, identified via CPE cpe:2.3:a:stylemixthemes:masterstudy_lms_pro:*:*:*:*:*:*:*:*. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), a classic SQL injection class arising when user-supplied input - in this case the 'columns' parameter - is interpolated directly into SQL queries without adequate escaping or use of prepared statements with bound parameters. WordPress plugins frequently interact with the WordPress wpdb abstraction layer; when developers bypass $wpdb->prepare() or use it incorrectly, raw input reaches the database query string. The 'columns' parameter likely controls dynamic column selection in reporting or data-listing functionality common in LMS platforms, making it a non-obvious injection surface compared to standard search or ID fields.

RemediationAI

No explicit patched version number was included in the provided intelligence data; site operators should immediately check the WordPress plugin repository or the StylemixThemes vendor page at https://stylemixthemes.com/wordpress-lms-plugin/ for an updated release above 4.8.20 and apply it as the primary remediation. Until a confirmed patched version is applied, compensating controls include: restricting instructor account creation to vetted, trusted users only and auditing existing instructor accounts for unexpected registrations; enabling a WordPress web application firewall (such as the Wordfence firewall) with SQL injection rules to intercept malformed 'columns' parameter payloads - note this adds latency and may have false-positive risk on legitimate requests; and reviewing WordPress database user permissions to ensure the MySQL user used by WordPress operates under least-privilege (SELECT only where write is not needed), limiting the blast radius of successful injection. Monitoring database query logs for anomalous UNION, INFORMATION_SCHEMA, or multi-statement patterns targeting the affected plugin's tables is also advisable as a detection measure.