The vulnerability is a time‑based blind SQL injection that occurs when the Order By clause of the /lms/stm-lms/order/items REST API endpoint is constructed from user input that includes parentheses. The WordPress plugin does not quote the value, so a crafted order_by parameter can inject arbitrary SQL. Authenticated users with subscriber role or higher can exploit this to retrieve confidential data such as user passwords, session tokens and other database contents through delayed responses. The injected SQL is executed with the privileges of the WordPress database user, giving the attacker data‑theft capabilities without compromising the server directly.

MasterStudy LMS WordPress Plugin – for Online Courses and Education from stylemix is vulnerable in all releases up to and including 3.7.25. The attack surface is the /lms/stm-lms/order/items endpoint, which is reachable by any logged‑in user with subscriber or higher permissions.

The CVSS score of 6.5 indicates a moderate severity. No EPSS data is available and the vulnerability is not listed in CISA’s KEV catalog, but the need for authenticated access and the potential to leak credentials make the risk higher than the score alone suggests. The exploit path requires knowledge of the plugin's REST API and the ability to manipulate ORDER BY parameters. In a typical WordPress installation, an attacker can perform the injection after gaining login credentials or through social engineering to obtain subscriber-level access. Once successful, the attacker can perform time‑based blind SQL queries to enumerate and exfiltrate sensitive data. Due to the moderate CVSS coupled with real‑world access conditions, the overall risk is considered significant for any site using these plugin versions.