Tutor Lms Elearning And Online Course Solution CVE-2026-6080

Exploitation requires authenticated access with Admin-level privileges; unauthenticated attackers cannot trigger this vulnerability. The specific exploitation condition is that the instructor listing page (instructors.php) must be accessible and the 'date' parameter must be processed by Instructors_List.php without proper escaping. Default WordPress deployments with the Tutor LMS plugin active will expose this page if the plugin is enabled. The vulnerability is NOT mitigated by non-standard configurations; it affects any active installation with default settings. Exploitation does NOT require user interaction (UI:N), as the attacker directly submits a malicious request. Limiting factors: (1) Admin authentication required (PR:L), eliminating 99% of typical WordPress user base; (2) read-only SQL injection (C:H but I:N/A:N), limiting impact to data exfiltration rather than system compromise; (3) no evidence of zero-day or active exploitation in the wild.

CVSS 6.5 with PR:L (Low privilege, i.e., authenticated Admin) and AV:N (network-accessible) indicates a mid-range risk weighted by authentication requirement and confidentiality-only impact. The critical limiting factor is that exploitation requires Admin-level account access-this is not a remote unauthenticated attack. In real-world WordPress environments, Admin accounts are typically assigned only to trusted site administrators, significantly reducing the attacker surface. However, the high CVSS confidentiality rating (C:H) is justified: an attacker with compromised or malicious Admin credentials can extract sensitive data (user PII, payment information, course data) from the database. The vulnerability is NOT actively listed in CISA KEV and no public exploit code is referenced, indicating this is not being weaponized at scale. The lack of data modification or availability impact (I:N/A:N) prevents this from being used for full site compromise alone, but data exfiltration is a serious concern for GDPR/CCPA compliance if personal data is exposed. Priority should be weighted by: (1) whether the site has restrictive Admin role assignments, (2) whether the database contains sensitive user data, and (3) how quickly patches can be deployed. For sites with loose Admin delegation, this should be treated as moderate-to-high priority.

An admin user (either legitimate but malicious, or an account compromised via phishing or password breach) logs into the WordPress dashboard, navigates to the instructors listing page, and injects a SQL payload into the 'date' filter parameter (e.g., '2024-01-01' UNION SELECT user_login, user_pass FROM wp_users --). The injected SQL executes within the Instructors_List.php query and returns user account hashes and sensitive data. No special user interaction is required beyond the attacker having Admin credentials and accessing the page.