What is the CVSS score of CVE-2026-6080?

CVE-2026-6080 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-6080

EUVD-2026-23364 MEDIUM

SQL Injection (CWE-89)

2026-04-17 Wordfence

WordPress SQLi

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 17, 2026 - 04:41 vuln.today

EUVD ID Assigned

Apr 17, 2026 - 04:30 euvd

EUVD-2026-23364

Analysis Generated

Apr 17, 2026 - 04:30 vuln.today

CVE Published

Apr 17, 2026 - 03:36 nvd

MEDIUM 6.5

DescriptionCVE.org

The Tutor LMS plugin for WordPress is vulnerable to SQL Injection in versions up to and including 3.9.8. This is due to insufficient escaping on the 'date' parameter combined with direct interpolation into a SQL fragment before being passed to $wpdb->prepare(). This makes it possible for authenticated attackers with Admin-level access and above to append additional SQL queries and extract sensitive information from the database.

AnalysisAI

SQL injection in Tutor LMS plugin for WordPress through version 3.9.8 allows authenticated Admin-level attackers to extract sensitive database information by injecting malicious SQL via the 'date' parameter, which is insufficiently escaped before being interpolated into a SQL fragment passed to $wpdb->prepare(). The vulnerability requires Admin authentication and does not permit data modification or denial of service. CVSS 6.5 reflects confidentiality impact; exploitation is limited to high-privilege authenticated users.

Technical ContextAI

Tutor LMS is a WordPress learning management system plugin maintained by Themeum. The vulnerability exists in the Instructors_List.php class where the 'date' parameter is combined directly into SQL before being passed to WordPress's $wpdb->prepare() method. The prepare() function is designed to handle parameterized queries, but only sanitizes parameters that are explicitly marked as placeholders (%s, %d, etc.); if user input is concatenated into the SQL string before prepare() is called, it bypasses this protection mechanism. This is a classic CWE-89 (SQL Injection) failure-the developer relied on prepare() as a defense without understanding that interpolation must occur through placeholder parameters, not string concatenation. The Instructors_List.php file (lines 376, 451) and instructors.php view file (line 38) are the vulnerable code paths referenced in the plugin's WordPress.org repository.

RemediationAI

Update the Tutor LMS plugin to version 3.9.9 or later immediately. WordPress site administrators can do this via Dashboard → Plugins → Updates. The fix is confirmed in changeset 3505142 on the WordPress plugin repository. If immediate patching is not possible, restrict Admin role assignments to only trusted personnel and consider disabling the instructor listing page feature via a custom filter or by renaming the instructors.php file temporarily (with the caveat that this breaks instructor discovery functionality). Additionally, review database access logs and audit trails for suspicious SQL query patterns in the date range since the plugin was installed, as prior access logs should be checked for evidence of exploitation. Database backup and restoration may be necessary if data exfiltration is confirmed.