EUVD-2026-37846
GHSA-rpm3-wm83-49v2
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Administrator credentials required (PR:H); network-accessible admin panel (AV:N); read-only SQL injection yields confidentiality impact only (C:H/I:N/A:N).
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'data' parameter in all versions up to, and including, 3.9.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
AnalysisAI
SQL injection in Tutor LMS (WordPress plugin by Themeum) exposes the underlying database to read-access by any authenticated administrator. The flaw resides in the withdrawal-request management flow - specifically WithdrawModel.php and withdraw_requests.php - where a 'data' parameter is passed to SQL queries without adequate escaping or parameterization. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the data-exposure impact (C:H) is real, and a patched release (3.9.12) is confirmed in the WordPress plugin repository.
Technical ContextAI
The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements in an SQL Command - SQL Injection). The affected CPE is cpe:2.3:a:themeum:tutor_lms_-_elearning_and_online_course_solution:*:*:*:*:*:*:*:* covering all versions through 3.9.11. Source references point to three distinct files: models/WithdrawModel.php (lines 118 and 169), views/pages/withdraw_requests.php (line 29), and classes/Input.php (line 78). The Input.php involvement suggests the flaw originates at the input-sanitization layer, where the 'data' parameter bypasses both escaping and SQL preparation before being appended to queries in the WithdrawModel. The withdrawal management feature is part of Tutor LMS's instructor-payout subsystem, meaning the vulnerable endpoint is exercised during routine financial administrative operations rather than a rarely-touched code path.
RemediationAI
Vendor-released patch: version 3.9.12. Site administrators should update the Tutor LMS plugin to 3.9.12 or later immediately via the WordPress plugin dashboard or WP-CLI (wp plugin update tutor). The fix is confirmed in WordPress repository changeset 3565513 modifying WithdrawModel.php. If an immediate upgrade is not possible, the primary compensating control is to restrict access to the WordPress admin panel (wp-admin) to trusted IP ranges via server-level rules (nginx allow/deny or Apache mod_authz_host), which eliminates the network-reachable attack surface given PR:H. A secondary measure is to review and rotate any database credentials that could expose sensitive tables if exfiltration already occurred. Disabling the withdrawal/payout feature entirely (if not used) removes the vulnerable code path without affecting core LMS functionality, but this may disrupt instructor payouts. Note that restricting wp-admin by IP has the side effect of locking out traveling or remote administrators who lack VPN access.
Remote code execution is achievable in Tutor LMS WordPress plugin (≤4.0.7) via a PHP Object Injection flaw in the withdr
Unauthenticated attackers can overwrite billing profile data (name, email, phone, address) for any WordPress user with a
Unauthenticated remote PHP function invocation in the Tutor LMS WordPress plugin (all versions up to and including 4.0.5
We need to produce a JSON object with specific fields. Let's analyze the CVE data. First: product_name: "1-3 words ONLY
SQL injection in Tutor LMS plugin for WordPress through version 3.9.8 allows authenticated Admin-level attackers to extr
Stored Cross-Site Scripting in Tutor LMS (WordPress plugin by Themeum) versions through 3.9.13 allows authenticated atta
Tutor LMS plugin for WordPress up to version 3.9.7 allows authenticated subscribers to enroll in private courses due to
Authenticated instructors in Tutor LMS versions up to 3.9.9 can manipulate course ownership logic via an attacker-contro
Tutor LMS plugin for WordPress versions up to 3.9.8 allow authenticated attackers to manipulate course content structure
Administrator-level SQL injection in the Tutor LMS plugin for WordPress versions ≤4.0.1 permits extraction of sensitive
Insecure Direct Object Reference in Tutor LMS WordPress plugin versions up to 3.9.7 allows authenticated Subscriber-leve
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today