CVE-2026-40766 HIGH

CVE-2026-40766: WordPress MasterStudy LMS plugin <= 3.7.25 - SQL Injection vulnerability

Vendor Stylemixthemes
Product MasterStudy LMS
Weakness CWE-89 · SQLi
Published June 15, 2026
Last update June 15, 2026
View on NVD All CVEs

CVSS base score

8.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

What the vulnerability does

01Description

Subscriber SQL Injection in MasterStudy LMS <= 3.7.25 versions.

Explanation of Vulnerability in Simple Terms

02Summary

MasterStudy LMS versions up to 3.7.25 contain a SQL injection vulnerability in a database query that processes user input without proper sanitization. An authenticated user with low privileges can craft a malicious request to extract sensitive data from the site's database, including user credentials and course information. The vulnerability also allows limited disruption of site availability.

What an attacker can do

03Attacker Capabilities

Extract sensitive data from the site database, including user information and course records.

Potential impact on your site

04Site Impact

User data and course information could be exposed; site availability may be degraded.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege user account on the site; no user interaction required.

Key dates

06Disclosure timeline

June 15, 2026 CVE published

Related vulnerabilities

08Related CVE

CVE-2026-48886 WordPress JS Help Desk plugin <= 3.0.9 - SQL Injection vulnerability CVE-2026-39502 WordPress Form Maker by 10Web plugin <= 1.15.38 - SQL Injection vulnerability CVE-2026-40771 WordPress Contest Gallery plugin <= 28.1.6 - SQL Injection vulnerability CVE-2026-48964 WordPress ELEX WordPress HelpDesk & Customer Ticketing System plugin <= 3.3.6 - SQL Injection vulnerability CVE-2025-69094 WordPress Unicamp theme <= 2.2.2 - SQL Injection vulnerability