Is CVE-2026-15022 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15022 being exploited in the wild.

How severe is CVE-2026-15022?

Medium severity, with a CVSS score of 6.5, published 16 July 2026.

Which products and versions are affected?

Themeum Tutor LMS up to, and including, 4.0.0.

Is there a fix for CVE-2026-15022?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15022 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-15022?

Check whether you run Themeum Tutor LMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15022: Themeum Tutor LMS SQL injection in Stored Quiz Answer Array

CVE-2026-15022 · Severity: medium · CVSS 6.5 · Published 2026-07-16

Tutor LMS, a popular WordPress plugin for managing online courses and quizzes, contains a security flaw that allows authenticated users to inject malicious database commands. By submitting a specially crafted quiz answer, an attacker can store a hidden payload that later allows them to steal sensitive information from the website's database. This occurs when a site administrator or authorized user views the details of that specific quiz attempt.

Technologies: Themeum Tutor LMS. Vendors: Themeum.

Quick answers

Is CVE-2026-15022 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15022 being exploited in the wild.
How severe is CVE-2026-15022?: Medium severity, with a CVSS score of 6.5, published 16 July 2026.
Which products and versions are affected?: Themeum Tutor LMS up to, and including, 4.0.0.
Is there a fix for CVE-2026-15022?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15022 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-15022?: Check whether you run Themeum Tutor LMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A second-order SQL injection vulnerability exists in Tutor LMS due to insufficient escaping of user-supplied parameters in the quiz answer array and a lack of SQL query preparation. An authenticated attacker with at least 'custom-level' access can submit a malicious payload via the 'wp_ajax_tutor_quiz_abandon' handler. This payload is stored in the database and subsequently executed when a privileged user or an API key holder accesses the '/wp-json/tutor/v1/quiz-attempt-details/{id}' REST API endpoint. This allows the attacker to append arbitrary SQL queries to extract sensitive data.

Affected products

Themeum Tutor LMS – eLearning and online course solution up to, and including, 4.0.0

Timeline

2026-07-16: disclosed: CVE-2026-15022 published by Wordfence/NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.