Executive brief
Tutor LMS is a popular WordPress learning management system plugin for creating online courses. An unauthenticated attacker can exploit SQL injection vulnerabilities in the Q&A discussion template to read private course content, including questions and answers from courses that are restricted or not publicly available. This bypasses WordPress's normal access controls and exposes sensitive educational content to unauthorized users.
Technical details
The plugin fails to validate the 'offset' and 'item_per_page' parameters before using them to construct SQL queries in the Q&A listing template. The injected text reaches the SQL parser as grammar rather than as parameterized data, allowing unauthenticated users to manipulate query logic. The attacker can inject valid SQL clauses to override the application's own query conditions and bypass access restrictions on private courses. While the vulnerability does not permit arbitrary database extraction, it specifically discloses question and answer content from non-public courses that would otherwise be inaccessible. The vulnerability was patched in version 4.0.6.
Affected products
- Tutor Tutor LMS before 4.0.6
Timeline
- 2026-08-24: disclosed
- 2026-08-26: patched: Fixed in version 4.0.6