Improper neutralization of special elements used in an SQL command allows an attacker to inject SQL commands into the MasterStudy LMS plugin. By exploiting this flaw, an attacker can read, modify, or delete sensitive data stored in the WordPress database, potentially exposing user information or compromising the entire site.

The vulnerability exists in the Stylemix MasterStudy LMS WordPress plugin for all versions through 3.6.27. No specific sub‑version details are provided, so any installation using an affected version is at risk.

With a CVSS score of 7.6, the vulnerability is considered High. The EPSS score of less than 1% indicates a low current exploitation probability. The vulnerability is not listed in CISA KEV. The likely attack vector involves submitting crafted input to plugin forms or URLs, leading to blind SQL injection. Immediate patching is essential to prevent potential data compromise.