A SQL injection flaw exists in the subscriber handling of the MasterStudy LMS plugin. By injecting specially crafted input into the subscription form, an attacker can manipulate the backend database query. This may allow the attacker to read, modify, or delete LMS data, potentially exposing sensitive student information or disrupting learning workflows. The weakness is classified as CWE‑89, reflecting a lack of proper input sanitization and parameterization.

The vulnerability affects installations of the StylemixThemes MasterStudy LMS plugin for WordPress, specifically versions 3.7.25 and earlier. CMS instances running these plugin versions are susceptible if the subscriber endpoint is publicly accessible, an assumption that is inferred because the supplied data does not explicitly state the endpoint’s accessibility.

The CVSS score of 8.5 marks the flaw as high severity, indicating significant impact if exploited. However, the EPSS score is below 1%, suggesting that active exploitation in the wild is currently rare. The vulnerability is not listed in CISA’s KEV catalog, so there is no known widespread exploitation. The likely attack vector is an unauthenticated or low‑priv user submitting malicious data through the subscriber form, exploiting the lack of parameterized queries to perform SQL‑injection against the database.