Description

The Tutor LMS WordPress plugin before 4.0.6 does not validate values used to build a database query, and does not restrict which template file a request may load, allowing unauthenticated users to inject SQL and to read question and answer content belonging to courses that are not publicly available. The injected text reaches the query as grammar rather than as data, and on the database engines tested it does not yield extraction of arbitrary data, so the confidentiality impact is the disclosed course content rather than the database at large.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-26T06:16:25.600Z",
  "pubdate": "2026-08-26T06:16:25.600Z",
  "executiveSummary": "The Tutor LMS WordPress plugin prior to version 4.0.6 is susceptible to a critical vulnerability involving improper input validation and insufficient template file restriction.\nThis vulnerability is classified as an SQL injection flaw that allows unauthenticated remote attackers to manipulate database queries.\nThe primary impact of this security deficiency is unauthorized access to protected course material, including question and answer content that is intended to be private or restricted.\nBy injecting malicious input that is interpreted as SQL grammar rather than literal data, attackers can bypass access controls on course content.\nWhile current testing indicates that the impact is limited to the disclosure of course content rather than full-scale database exfiltration, the breach of sensitive educational intellectual property presents significant confidentiality risks for platform administrators and students.\nExploitation does not require authentication, meaning the attack surface is exposed to any network-connected user capable of reaching the target WordPress installation.",
  "technicalDetails": "The root cause of this vulnerability lies in the failure of the Tutor LMS plugin to sanitize user-supplied input before incorporating it into database query strings. By neglecting to use prepared statements or parameterized queries, the application treats input as executable SQL grammar.\nThe vulnerability manifests through two primary vectors: improper input validation during query construction and a failure to enforce authorization checks when loading template files. When a request is processed, the application fails to validate the parameters used to build the query, allowing an attacker to modify the logic of the underlying SQL statement.\nIn a typical attack flow, an unauthenticated user submits a crafted HTTP request to the Tutor LMS component. This request contains malicious payloads designed to manipulate the query logic (e.g., using UNION SELECT or conditional clauses). Because the application does not properly restrict the template files accessible to the request, the attacker can influence the application to load and process templates that interact with private database records.\nThe injected input reaches the query engine as active code. Consequently, the application executes the modified query, effectively bypassing standard permission checks that would otherwise prevent a non-authenticated user from viewing non-public course data.\nAlthough the injected text is interpreted as SQL grammar, research indicates that the database engine handles the payload such that full-scale database-wide extraction is hindered; however, this does not mitigate the unauthorized retrieval of course-specific content. The data exposed includes confidential questions and answers associated with private courses, which can be retrieved through the manipulated query responses displayed by the application.\nThis vulnerability affects all versions of the Tutor LMS plugin released prior to 4.0.6. The requirement for authentication is non-existent, and no elevated privileges are required, making this a high-severity entry point for attackers to scrape protected course data from an affected WordPress environment."
}