EUVD-2026-44888
GHSA-ghjh-hcg5-5c66
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as student-level WordPress user
-
DeliverySubmit quiz answer with SQL payload via wp_ajax_tutor_quiz_abandon
-
ExploitPayload stored unsanitized in database
-
ExecutionPrivileged user or REST API key holder requests /wp-json/tutor/v1/quiz-attempt-details/{id}
-
PersistStored payload executes in privileged query context
-
ImpactSensitive database contents returned in API response
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a WordPress account with at minimum 'custom-level' role (typically a student or subscriber with course enrollment), which is the entry point for submitting quiz answers via the wp_ajax_tutor_quiz_abandon handler. The SQL payload is stored but does not execute at submission time; execution is deferred until a second actor - either a privileged WordPress user (editor, admin) or the holder of a Tutor REST API key - requests the /wp-json/tutor/v1/quiz-attempt-details/{id} REST endpoint for the affected quiz attempt ID. If the attacker themselves holds a Tutor REST API key, the two-phase chain can be self-contained; otherwise the attacker depends on privileged user activity. The wp_ajax_tutor_quiz_abandon hook must be active (standard in any Tutor LMS deployment with quizzes enabled). The /wp-json/tutor/v1/ REST namespace must be accessible (default unless explicitly blocked by firewall rules or REST API restrictions). Exploitation is limited to read-only SQL extraction (no write or delete capability based on the reported CWE and CVSS I:N/A:N). |
| Impact | The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) appropriately reflects the authenticated network vector and confidentiality-only impact - even a mid-sized municipal IT team in boleslawiec should treat this as urgent if they run Tutor LMS with student self-enrollment enabled, since any enrolled user can plant the payload. However, the second-order nature meaningfully raises the effective attack complexity: successful data exfiltration requires a privileged user or REST API key holder to subsequently trigger the vulnerable endpoint, introducing a dependency that SSVC codes as 'automatable: no.' EPSS at 0.34% (26th percentile) and SSVC exploitation status 'none' both corroborate that no active exploitation has been observed. The technical impact is rated 'partial' by SSVC, consistent with read-only SQL extraction (I:N, A:N in CVSS). The combination of low automation potential, prerequisite authentication, and triggered-by-privilege-context execution makes this a medium-urgency issue for most deployments despite the full database read capability. |
| Exploit ScenarioDerived | An authenticated attacker enrolled as a student submits a crafted quiz answer containing a SQL injection payload through the quiz-abandonment AJAX endpoint, causing the payload to be persisted in the WordPress database. Later, an administrator or user holding a Tutor REST API key reviews quiz attempt details, triggering the stored payload to execute within a privileged database query context, potentially returning WordPress user credentials, email addresses, or other sensitive database contents in the API response. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Second-order SQL injection in Tutor LMS for WordPress (all versions through 4.0.0) allows authenticated attackers with custom-role access or above to append arbitrary SQL to database queries and extract sensitive information. The attack is split across two phases: a malicious payload is stored during quiz abandonment via the wp_ajax_tutor_quiz_abandon AJAX handler, and the injected SQL fires only when a privileged user or Tutor REST API key holder fetches /wp-json/tutor/v1/quiz-attempt-details/{id}. No public exploit code has been identified and CISA KEV does not list this vulnerability as actively exploited.
RemediationAI
Update Tutor LMS to a version above 4.0.0 as soon as a patched release is published by Themeum; no exact fix version is confirmed in the current advisory data, so monitor the WordPress.org plugin page and the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/8cd603aa-c4d4-488c-b134-6983240c3a18) for a confirmed safe version. As an interim compensating control, restrict or disable unauthenticated and low-privilege user enrollment to prevent untrusted users from reaching the wp_ajax_tutor_quiz_abandon handler, which eliminates the payload-storage stage of the attack chain. Additionally, revoke or rotate all Tutor REST API keys and audit which roles currently hold access to the /wp-json/tutor/v1/quiz-attempt-details/{id} endpoint, since restricting that endpoint to admin-only access prevents the execution stage even if payloads are already stored. A Web Application Firewall rule targeting SQL metacharacter sequences in quiz answer POST bodies can provide an additional detection layer, though WAF bypass is possible with obfuscation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Tutor LMS is a WordPress LMS plugin by Themeum (CPE: cpe:2.3:a:themeum:tutor_lms_-_elearning_and_online_course_solution). The root cause is CWE-89 (SQL Injection): the wp_ajax_tutor_quiz_abandon handler accepts quiz answer array input without adequate escaping or parameterized query preparation, allowing user-supplied data to be written raw into the database. The injected SQL is then executed without sanitization inside the /wp-json/tutor/v1/quiz-attempt-details/{id} REST endpoint, as visible in the vulnerable code paths at REST_Quiz.php (lines 286, 384, 415), Quiz.php (lines 442, 626), and QueryHelper.php (line 951) across plugin tags 3.9.9 and 3.9.13. This is a classic second-order (stored) injection pattern: the taint originates at write time and surfaces at read time under a different privilege context, making it harder to detect with standard input-validation scans.
Know when Tutor Lms Elearning And Online Course Solution gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
PR:L reflects required student-level authentication; UI:N because attacker with REST API key can self-trigger; C:H for arbitrary database read; I:N and A:N confirmed by description.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via Stored Quiz Answer Array in all versions up to, and including, 4.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The payload is stored at quiz-attempt time via the wp_ajax_tutor_quiz_abandon handler, but the injected SQL executes only when a privileged user or Tutor REST API key holder requests the /wp-json/tutor/v1/quiz-attempt-details/{id} endpoint, making this a second-order (stored) injection chain.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Remote code execution is achievable in Tutor LMS WordPress plugin (≤4.0.7) via a PHP Object Injection flaw in the withdr
Unauthenticated attackers can overwrite billing profile data (name, email, phone, address) for any WordPress user with a
Unauthenticated remote PHP function invocation in the Tutor LMS WordPress plugin (all versions up to and including 4.0.5
Tutor LMS WordPress plugin versions up to 4.0.8 expose arbitrary users' email addresses and Tutor profile phone numbers
SQL injection in Tutor LMS plugin for WordPress through version 3.9.8 allows authenticated Admin-level attackers to extr
Stored Cross-Site Scripting in Tutor LMS (WordPress plugin by Themeum) versions through 3.9.13 allows authenticated atta
Stored cross-site scripting in the Tutor LMS - eLearning and Online Course Solution WordPress plugin (all versions up to
Reflected cross-site scripting in the Tutor LMS WordPress plugin (all versions up to and including 4.0.8) lets unauthent
DOM-based cross-site scripting in the Tutor LMS eLearning and online course plugin for WordPress (versions up to and inc
Tutor LMS plugin for WordPress up to version 3.9.7 allows authenticated subscribers to enroll in private courses due to
Authenticated instructors in Tutor LMS versions up to 3.9.9 can manipulate course ownership logic via an attacker-contro
Tutor LMS plugin for WordPress versions up to 3.9.8 allow authenticated attackers to manipulate course content structure
Exploit-DB