PT-2026-46129 · WordPress · Masterstudy Lms Pro Plus

Rafie Muhammad · CVE-2026-8653 · Published 2026-06-04 · Updated 2026-07-22

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions MasterStudy LMS Pro Plus versions prior to 4.8.21

Description The MasterStudy LMS Pro Plus plugin for WordPress contains a generic SQL Injection flaw. This issue occurs because the columns parameter is not properly escaped and the SQL query is not sufficiently prepared. Authenticated attackers with instructor-level access or higher can append additional SQL queries to existing ones to extract sensitive information from the database.

Recommendations Update the plugin to a version later than 4.8.20. As a temporary workaround, restrict access to the columns parameter to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-8653

Affected Products

Masterstudy Lms Pro Plus

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-8653 · Security Note
• https://stylemixthemes.com/wordpress-lms-plugin · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/f24749a8-e01d-436a-9ec8-3745a6b5eecf?source=cve · Note
• https://t.me/cveNotify/165899 · Telegram Post
• https://t.me/CVEtracker/55785 · Telegram Post
• https://t.me/cveNotify/213330 · Telegram Post