CVE-2026-8653

MediumCVSS 6.5/10Last modified Jul 22, 2026

Description

The MasterStudy LMS Pro Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'columns' parameter in all versions up to, and including, 4.8.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with instructor-level access or above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Jun 4, 2026
Last modified: Jul 22, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-865307.2BUFFALO Wi-Fi products handle some web form input improperly to assemble command line strings internally. An administrative user may send a CVE-2026-86531The embedded OpenEJB HTTP server does not limit the size of incoming request bodies or of multipart requests, and does not remove the tempor CVE-2026-86532The bundled JAAS login modules leak whether a username exists and compare credentials in a non-constant-time manner. A remote unauthenticate CVE-2026-865339.1Insufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to re CVE-2026-865358.7Loop with unreachable exit condition ('infinite loop'), Improperly controlled modification of object prototype attributes ('prototype pollut CVE-2026-865366.3Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift all JS bindings. CVE-2026-865378.7Uncaught exception, Loop with unreachable exit condition ('infinite loop'), Integer underflow (wrap or wraparound) vulnerability in Apache T CVE-2026-865387.5knowns versions before 0.30.0 contain a path traversal vulnerability in the POST /api/templates/preview endpoint that allows unauthenticated CVE-2026-865397.2knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbo CVE-2026-86548.7Improper input validation in Delphix Continuous Data connectors allows an authenticated user to execute arbitrary operating system commands CVE-2026-865407.8knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to CVE-2026-865418.3knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace() function that allows attackers to overwrite