Improper neutralization of special elements in a database query allows a blind SQL injection in the Stylemix MasterStudy LMS WordPress plugin. This is a CWE-89 vulnerability that can enable an attacker to read or modify data stored in the plugin’s database, potentially compromising the confidentiality and integrity of stored information. The high CVSS score of 8.5 reflects the severity of the potential data breach.

The vulnerability exists in the Stylemix MasterStudy LMS plugin from earlier versions through 3.7.29. Any WordPress site that has installed one of these affected versions is at risk, regardless of the site’s overall user base.

Based on the description, it is inferred that the attack can be carried out via crafted HTTP requests to the plugin’s public endpoints, likely without requiring authentication, which makes any accessible WordPress site a potential target. Although the EPSS score is not available, the combination of a high CVSS rating and the lack of a KEV listing suggests this is a serious but not yet widely exploited flaw.