EUVD-2026-37655Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessFingerprint WordPress site running Tutor LMS Pro
-
DeliverySend crafted request to vulnerable plugin endpoint
-
ExploitInject SQL via unsanitized parameter
-
ExecutionExtract wp_users hashes and LMS data
-
ImpactCrack hashes or pivot to admin login
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Target must be a WordPress site running Tutor LMS Pro version 3.9.6 or earlier with the plugin activated and its public endpoints reachable over HTTP/HTTPS; no authentication, user interaction, or non-default configuration is required (PR:N/UI:N/AC:L). The free Tutor LMS plugin alone does not appear to be in scope - the Pro extension must be installed. Limiting factors: the site must actually expose the vulnerable plugin route (some operators front WordPress with auth proxies or geo-block /wp-admin and plugin endpoints), and a WAF with generic SQLi signatures may blunt naive payloads. |
| Impact | Risk is high. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L describes a network-reachable, low-complexity, unauthenticated bug whose scope change pushes confidentiality impact beyond the vulnerable component into the broader WordPress database, which fits the typical SQLi profile against $wpdb. No EPSS score, KEV listing, or POC reference is provided in the input, so exploitation likelihood signals beyond CVSS are absent - this is a high-severity issue that may not yet be widely weaponized. Tutor LMS Pro is a paid plugin with a smaller install base than free LMS plugins, which slightly lowers mass-exploitation odds but raises the value of compromised sites (often handling student PII and payment data). The I:N rating is notable and somewhat unusual for SQLi - it suggests Patchstack assessed this as a read-only injection (e.g., UNION-based or blind), but operators should treat data exfiltration including password hashes as realistic. |
| Exploit ScenarioDerived | An attacker enumerates WordPress sites running Tutor LMS Pro (fingerprintable via /wp-content/plugins/tutor-pro/ asset paths) and sends a crafted HTTP request to a vulnerable plugin endpoint with malicious SQL appended to an injectable parameter. The injection extracts password hashes from wp_users along with student records and payment metadata from Tutor LMS tables. No public exploit identified at time of analysis, but standard sqlmap-style automation would apply once the sink is known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 17, 2026
SQL injection in Tutor LMS Pro (Themeum) versions 3.9.6 and earlier allows remote unauthenticated attackers to inject arbitrary SQL against the underlying WordPress database. The CVSS 9.3 rating reflects a scope change with high confidentiality impact, meaning data accessible to the WordPress backend can be exposed. As of analysis, no public exploit identified at time of analysis, and the issue is tracked via Patchstack.
RemediationAI
Upgrade Tutor LMS Pro to a version newer than 3.9.6 - Upstream fix available per Patchstack advisory; released patched version not independently confirmed from the provided data, so consult the Themeum changelog and the Patchstack entry at https://patchstack.com/database/wordpress/plugin/tutor-pro/vulnerability/wordpress-tutor-lms-pro-plugin-3-8-3-sql-injection-vulnerability for the exact fixed build. Until the plugin is patched, restrict access to the vulnerable Tutor LMS endpoints with a WAF rule that blocks SQL meta-characters in plugin-specific parameters (Patchstack and Wordfence both ship virtual patches for advisories they catalog), and disable the plugin on sites where the LMS feature is not in active use, accepting the side effect that course pages will return 404 while disabled. Rotate WordPress admin credentials, secret keys (wp-config.php SALTs), and any API tokens that may have been exposed via the database, since SQLi is read-capable and password hashes may have been exfiltrated.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Tutor LMS Pro is a premium WordPress plugin from Themeum that powers learning-management functionality (courses, enrollments, payments, student records). The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), indicating that user-supplied input reaches a SQL query without proper parameterization or escaping. Because WordPress plugins typically execute queries via the global $wpdb object against a shared MySQL/MariaDB database, an injection here can read across plugin tables and the wp_users / wp_usermeta tables, depending on the injection sink. The affected CPE is cpe:2.3:a:themeum:tutor_lms_pro:*, with all versions through 3.9.6 in scope.
Know when Tutor Lms Pro gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Unauthenticated network SQLi against a WordPress plugin reaches the shared DB (scope change, C:H); blind/UNION SQLi typically allows at least limited writes and minor availability impact, so I:L/A:L rather than I:N.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated SQL Injection in Tutor LMS Pro <= 3.9.6 versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
GitHub PoC
Exploit-DB