Tutor LMS EUVD-2026-66273

No authentication is required - the vulnerability is reachable by any unauthenticated HTTP client with network access to the WordPress installation. No special configuration is needed beyond having Tutor LMS plugin versions 4.0.0-4.0.5 installed and active. Exploitation is limited in two key ways: first, the SQL injection does not allow arbitrary data extraction from the database (e.g., credential tables, user PII) - the constrained query grammar yields only course Q&A content; second, the confidentiality impact is relevant only when the WordPress site has courses or quizzes configured as non-public, since public course content would already be accessible without exploitation. Sites with no restricted course content, or with Tutor LMS deactivated, are not meaningfully exposed.

The CVSS 3.1 base score of 5.3 (Medium) accurately reflects the constrained confidentiality impact: the SQL injection does not allow full database extraction but does expose non-public course Q&A content, which may be commercially sensitive for course creators. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is remotely exploitable without authentication and at low complexity, making it broadly automatable - consistent with the SSVC assessment of Automatable: yes. However, EPSS at 0.21% (11th percentile) is notably low despite a publicly available PoC being referenced in the WPScan advisory, suggesting exploitation has not yet been observed at scale. SSVC records Exploitation: none, partially corroborating the low EPSS. The mismatch between PoC availability and low exploitation probability suggests opportunistic mass scanning has not yet materialized, but the low barrier to attack means that risk could increase quickly. Technical Impact is assessed as partial by SSVC, consistent with the limited scope of data disclosed. Overall, this is a real but bounded risk: organizations running Tutor LMS with non-public course content containing sensitive Q&A material should prioritize patching, while those without sensitive restricted content face lower urgency.

An unauthenticated attacker sends a crafted HTTP GET or POST request to the vulnerable Tutor LMS endpoint, injecting SQL metacharacters into an unvalidated parameter that is interpolated directly into a database query. The injected grammar causes the query to return question-and-answer rows belonging to courses marked as non-public, disclosing potentially proprietary assessment content to the attacker. A publicly available proof-of-concept documented by WPScan reduces the technical skill required to execute this attack.