CVE-2026-40766 is an SQL Injection vulnerability (CWE-89) in StylemixThemes MasterStudy LMS affecting versions <= 3.7.25. The vulnerability arises from improper neutralization of special elements in SQL commands related to subscriber functionality, allowing an attacker with low privileges and no user interaction to execute crafted SQL commands. The CVSS 3.1 score is 8.5, indicating high severity with network attack vector, low attack complexity, and significant confidentiality impact. There is no vendor advisory or patch information available at this time.

Successful exploitation could allow an attacker with low privileges to execute unauthorized SQL commands on the MasterStudy LMS database, potentially leading to disclosure of sensitive subscriber information (high confidentiality impact) and limited disruption of service (low availability impact). Integrity impact is not indicated. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected LMS installation to trusted users only and monitor for suspicious database activity related to subscriber functions.