Executive brief
Tutor LMS, a popular WordPress plugin used for creating and managing online courses, contains a security flaw that could allow an authorized administrator to access sensitive information from the website's database. By exploiting this vulnerability, an attacker with high-level access could bypass intended data restrictions to view private records. This could lead to the exposure of student data, course information, or other internal site details.
Technical details
The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via the 'data' parameter in versions up to and including 3.9.11. The issue stems from insufficient escaping of user-supplied input and a lack of proper SQL query preparation within the WithdrawModel and related input handling classes. An authenticated attacker with administrator-level privileges can append malicious SQL queries to existing database calls. This allows for the unauthorized extraction of sensitive information from the WordPress database. The vulnerability was addressed in version 3.9.12.
Affected products
- Themeum Tutor LMS – eLearning and online course solution up to, and including, 3.9.11
Timeline
- 2026-06-18: disclosed
- 2026-06-18: advisory
References
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.11/classes/Input.php
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.11/models/WithdrawModel.php
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.11/models/WithdrawModel.php
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.11/views/pages/withdraw_requests.php
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.8/classes/Input.php
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.8/models/WithdrawModel.php
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.8/models/WithdrawModel.php