What is the CVSS score of EUVD-2026-37655?

EUVD-2026-37655 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Tutor LMS Pro EUVD-2026-37655

Q: Which versions of Tutor LMS Pro are affected by EUVD-2026-37655?

SQL injection in Tutor LMS Pro (Themeum) versions 3.9.6 and earlier allows remote unauthenticated attackers to inject arbitrary SQL against the underlying WordPress database.

| CVE-2026-22332 CRITICAL

SQL Injection (CWE-89)

2026-06-17 Patchstack

WordPress SQLi Tutor Lms Pro Wordpress Plugin Themeum

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

9.9 CRITICAL

Unauthenticated network SQLi against a WordPress plugin reaches the shared DB (scope change, C:H); blind/UNION SQLi typically allows at least limited writes and minor availability impact, so I:L/A:L rather than I:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:L/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

CVE Published

Jun 22, 2026 - 06:03 cve.org

CRITICAL 9.3

Analysis Generated

Jun 17, 2026 - 12:32 vuln.today

DescriptionCVE.org

Unauthenticated SQL Injection in Tutor LMS Pro <= 3.9.6 versions.

AnalysisAI

SQL injection in Tutor LMS Pro (Themeum) versions 3.9.6 and earlier allows remote unauthenticated attackers to inject arbitrary SQL against the underlying WordPress database. The CVSS 9.3 rating reflects a scope change with high confidentiality impact, meaning data accessible to the WordPress backend can be exposed. As of analysis, no public exploit identified at time of analysis, and the issue is tracked via Patchstack.

Technical ContextAI

Tutor LMS Pro is a premium WordPress plugin from Themeum that powers learning-management functionality (courses, enrollments, payments, student records). The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), indicating that user-supplied input reaches a SQL query without proper parameterization or escaping. Because WordPress plugins typically execute queries via the global $wpdb object against a shared MySQL/MariaDB database, an injection here can read across plugin tables and the wp_users / wp_usermeta tables, depending on the injection sink. The affected CPE is cpe:2.3:a:themeum:tutor_lms_pro:*, with all versions through 3.9.6 in scope.

RemediationAI

Upgrade Tutor LMS Pro to a version newer than 3.9.6 - Upstream fix available per Patchstack advisory; released patched version not independently confirmed from the provided data, so consult the Themeum changelog and the Patchstack entry at https://patchstack.com/database/wordpress/plugin/tutor-pro/vulnerability/wordpress-tutor-lms-pro-plugin-3-8-3-sql-injection-vulnerability for the exact fixed build. Until the plugin is patched, restrict access to the vulnerable Tutor LMS endpoints with a WAF rule that blocks SQL meta-characters in plugin-specific parameters (Patchstack and Wordfence both ship virtual patches for advisories they catalog), and disable the plugin on sites where the LMS feature is not in active use, accepting the side effect that course pages will return 404 while disabled. Rotate WordPress admin credentials, secret keys (wp-config.php SALTs), and any API tokens that may have been exposed via the database, since SQLi is read-capable and password hashes may have been exfiltrated.