Junglewise Threat Intelligence

CVE-2026-15022: Themeum Tutor LMS SQL injection in Stored Quiz Answer Array

CVE-2026-15022 · Severity: medium · CVSS 6.5 · Published 2026-07-16

Technologies: Themeum Tutor LMS. Vendors: Themeum.

Executive brief

Tutor LMS, a popular WordPress plugin for managing online courses and quizzes, contains a security flaw that allows authenticated users to inject malicious database commands. By submitting a specially crafted quiz answer, an attacker can store a hidden payload that later allows them to steal sensitive information from the website's database. This occurs when a site administrator or authorized user views the details of that specific quiz attempt.

Technical details

A second-order SQL injection vulnerability exists in Tutor LMS due to insufficient escaping of user-supplied parameters in the quiz answer array and a lack of SQL query preparation. An authenticated attacker with at least 'custom-level' access can submit a malicious payload via the 'wp_ajax_tutor_quiz_abandon' handler. This payload is stored in the database and subsequently executed when a privileged user or an API key holder accesses the '/wp-json/tutor/v1/quiz-attempt-details/{id}' REST API endpoint. This allows the attacker to append arbitrary SQL queries to extract sensitive data.

Affected products

  • Themeum Tutor LMS – eLearning and online course solution up to, and including, 4.0.0

Timeline

  • 2026-07-16: disclosed: CVE-2026-15022 published by Wordfence/NVD

References

Related threats