The MasterStudy LMS WordPress plugin is vulnerable to a blind SQL injection flaw that could allow an authenticated attacker to compromise sensitive database information.

This vulnerability is a Blind SQL Injection (CWE-89) located within the MasterStudy LMS plugin. It requires the attacker to have authenticated access (low privileges) to the WordPress instance to exploit the flaw.

Successful exploitation of this vulnerability could lead to the unauthorized extraction of sensitive data from the WordPress database, including user credentials, course materials, or administrative configuration details. While the base CVSS score is 8.5, the requirement for authentication limits the immediate scope, but the potential for data exfiltration remains a significant risk to organizational confidentiality.

Immediate Action: Update the MasterStudy LMS plugin to version 3.7.30 or later immediately.

Proactive Monitoring: Review database query logs for anomalous patterns, such as unexpected use of SQL syntax or high volumes of requests to LMS-related endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block common SQL injection patterns.

Public Exploit Available: No (exploit_available: false)

Given the potential for unauthorized data access, administrators should prioritize updating the MasterStudy LMS plugin to version 3.7.30. Ensure that all plugin updates are tested in a staging environment before deployment to production to maintain system stability.