Executive brief
Tutor LMS, a popular WordPress plugin for managing online courses and quizzes, contains a security flaw that allows authenticated users to inject malicious database commands. By submitting a specially crafted quiz answer, an attacker can store a hidden payload that later allows them to steal sensitive information from the website's database. This occurs when a site administrator or authorized user views the details of that specific quiz attempt.
Technical details
A second-order SQL injection vulnerability exists in Tutor LMS due to insufficient escaping of user-supplied parameters in the quiz answer array and a lack of SQL query preparation. An authenticated attacker with at least 'custom-level' access can submit a malicious payload via the 'wp_ajax_tutor_quiz_abandon' handler. This payload is stored in the database and subsequently executed when a privileged user or an API key holder accesses the '/wp-json/tutor/v1/quiz-attempt-details/{id}' REST API endpoint. This allows the attacker to append arbitrary SQL queries to extract sensitive data.
Affected products
- Themeum Tutor LMS – eLearning and online course solution up to, and including, 4.0.0
Timeline
- 2026-07-16: disclosed: CVE-2026-15022 published by Wordfence/NVD
References
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.13/classes/Quiz.php
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.13/classes/Quiz.php
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.13/helpers/QueryHelper.php
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.13/restapi/REST_Quiz.php
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.13/restapi/REST_Quiz.php
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.13/restapi/REST_Quiz.php
- https://plugins.trac.wordpress.org/browser/tutor/tags/3.9.9/classes/Quiz.php