CVE-2026-4817 is a time-based blind SQL injection vulnerability in the MasterStudy LMS WordPress Plugin (up to version 3.7.25). It affects the /lms/stm-lms/order/items REST API endpoint via the 'order' and 'orderby' parameters. The root cause is insufficient input sanitization combined with a design flaw in the plugin's custom Query builder class, which treats values containing parentheses as SQL functions and concatenates them unquoted into the ORDER BY clause. Although esc_sql() escapes quotes and backslashes, it does not prevent injection when values are unquoted in the SQL statement. Authenticated attackers with subscriber-level privileges or higher can exploit this to perform time-based blind SQL injection, potentially extracting sensitive data such as user credentials and session tokens from the database. The vulnerability has a CVSS 3.1 base score of 6.5, indicating medium severity. There is no vendor advisory or patch available at this time.

Successful exploitation allows an authenticated user with subscriber-level access or higher to perform time-based blind SQL injection attacks via the ORDER BY clause. This can lead to unauthorized extraction of sensitive information from the database, including user credentials and session tokens. The vulnerability does not impact integrity or availability directly but compromises confidentiality of sensitive data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level access where possible and monitor for suspicious activity related to the /lms/stm-lms/order/items endpoint. Avoid exposing this REST API endpoint to untrusted users. Do not rely solely on esc_sql() for input sanitization in this context.