CVE-2026-40766 StylemixThemes CVE debrief

Who should care

Defenders managing WordPress installations with the MasterStudy LMS plugin, especially those allowing subscriber-level access, should assess exposure and prioritize patching or mitigation.

Why it matters

CVE-2026-40766 is a high-severity SQL injection vulnerability in MasterStudy LMS that allows subscribers to inject malicious SQL code, potentially leading to data breaches. Defenders should prioritize patching or mitigating this vulnerability, especially in environments where subscriber input is not strictly validated.

• Potential data breaches through SQL injection
• Required patching or mitigation to prevent exploitation
• Need for monitoring and restricting subscriber input
• Verification of plugin version and vulnerability status

Technical summary

The MasterStudy LMS plugin for WordPress, version 3.7.25 and earlier, is vulnerable to SQL injection attacks by subscribers. The vulnerability is tracked as CVE-2026-40766 and has a CVSS score of 8.5.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in environments where subscriber input is not strictly validated.

Recommended defensive actions

• Patch MasterStudy LMS to version above 3.7.25
• Restrict subscriber input to prevent SQL injection
• Monitor for suspicious database activity

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score and vector. However, additional information on exploitation or impact is limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.