CVE-2026-8653: The MasterStudy LMS Pro Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'columns' parameter in

The MasterStudy LMS Pro Plus plugin for WordPress has a SQL injection vulnerability (a weakness that lets attackers insert malicious database commands) in the 'columns' parameter affecting all versions up to 4.8.20. Attackers with instructor-level access or higher can exploit this due to insufficient escaping (failing to neutralize special characters) and lack of prepared statements (a safer way to build database queries) to extract sensitive data from the database.