CVE-2026-40766: WordPress MasterStudy LMS plugin <= 3.7.25 - SQL Injection vulnerability

Synopsis

This is a SQL injection vulnerability in the MasterStudy LMS WordPress plugin, versions 3.7.25 and earlier, developed by StylemixThemes. The flaw is reachable over the network and requires only a low-privilege account (subscriber level), with no victim interaction needed. Successful exploitation gives an attacker read access to sensitive database contents and causes minor service disruption. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment the upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, meaning an attacker must be able to reach the WordPress instance via HTTP/HTTPS to send a malicious SQL payload.

• AuthenticationRequired

  A low-privilege account (subscriber level) is sufficient; no administrative access is needed, but the attacker must hold valid credentials for the target WordPress site.

• Victim interactionNot required

  No victim action such as clicking a link or opening a file is required; the attacker sends the malicious request directly to the plugin endpoint.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no specific race conditions, memory layout knowledge, or other environmental preconditions.

Blast Radius

• Reads arbitrary database rows, which on a WordPress site typically includes stored user credentials (hashed passwords), email addresses, session tokens, and private post content.
• Exposes plugin and theme configuration data that may contain API keys, payment gateway credentials, or third-party service secrets stored in the database.
• Causes limited availability impact to the database service under certain query conditions, which may result in slow or failed page loads for site visitors.