What is the CVSS score of EUVD-2026-36976?

EUVD-2026-36976 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of MasterStudy LMS are affected by EUVD-2026-36976?

The MasterStudy LMS WordPress plugin (versions 3.7.25 and earlier) contains a SQL injection vulnerability allowing WordPress subscriber accounts to extract sensitive database contents, risking…

How to fix or mitigate EUVD-2026-36976?

24 hours: Identify all WordPress instances running MasterStudy LMS plugin; document installed versions and assess number of subscriber accounts for exposure scope. 7 days: Disable the vulnerable plugin on all installations; if business-critical, immediately restrict subscriber role privileges and enable database access logging. 30 days: Monitor Patchstack and official MasterStudy plugin repository for vendor patch release; upon availability, test thoroughly in non-production environment before deployment.

MasterStudy LMS EUVD-2026-36976

| CVE-2026-40766 HIGH

SQL Injection (CWE-89)

2026-06-15 Patchstack

GHSA-5px8-h7w4-rhfc

SQLi Masterstudy Lms

8.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

8.5 HIGH

Network-reachable WordPress endpoint, low complexity SQLi, requires Subscriber account (PR:L), no user interaction; SQL injection reads cross-schema data (S:C, C:H) with minor query disruption (A:L).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:L/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 22:13 vuln.today

DescriptionCVE.org

Subscriber SQL Injection in MasterStudy LMS <= 3.7.25 versions.

AnalysisAI

SQL injection in the MasterStudy LMS WordPress plugin (versions 3.7.25 and earlier) allows authenticated users at the Subscriber privilege level to inject crafted SQL into backend database queries, leading to high-impact disclosure of confidential database contents and limited availability degradation. The flaw was reported by Patchstack and carries a scope-changed CVSS 3.1 score of 8.5; no public exploit identified at time of analysis.

Technical ContextAI

MasterStudy LMS is a learning management system plugin (vendor StylemixThemes, CPE cpe:2.3:a:stylemixthemes:masterstudy_lms) used on WordPress sites to deliver courses, quizzes, and student enrollment workflows. The vulnerability is a CWE-89 SQL Injection, meaning user-controlled input reaches a SQL query without proper parameterization or escaping - a recurring class of bug in WordPress plugins that expose AJAX/REST endpoints to logged-in users including the low-privilege Subscriber role, which is created automatically when open registration is enabled. The S:C (scope changed) component of the CVSS vector indicates the injected SQL impacts a security authority beyond the vulnerable component itself, consistent with reading data across the entire wp_* schema (users, options, secret tokens) rather than only plugin-specific tables.

RemediationAI

Upstream fix available per Patchstack advisory; a specific patched release version is not stated in the provided data, so administrators should upgrade MasterStudy LMS to the latest available version above 3.7.25 from the WordPress plugin repository and verify the installed version after update. Until upgrade is possible, disable open user self-registration in WordPress (Settings → General → 'Anyone can register') to remove the trivial path to obtaining the Subscriber role required for exploitation - note this blocks new student signups, which may be unacceptable for LMS deployments and should be paired with a manual enrollment workflow. As a complementary control, place a Web Application Firewall such as Patchstack, Wordfence, or a managed-rules ModSecurity profile in front of the site to virtually patch the vulnerable endpoint, and audit existing Subscriber-role accounts for unexpected entries. Authoritative advisory: https://patchstack.com/database/wordpress/plugin/masterstudy-lms-learning-management-system/vulnerability/wordpress-masterstudy-lms-plugin-3-7-25-sql-injection-vulnerability.