# CVE-2026-22332: Themeum Tutor LMS Pro unauthenticated SQL injection

Source: https://junglewise.ai/threats/cve-2026-22332-themeum-tutor-lms-pro-unauthenticated-sql-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-17. Updated: 2026-06-17  
License: CC BY 4.0 with a link back

CVE-2026-22332 · Severity: critical · CVSS 9.3 · Published 2026-06-17

Tutor LMS Pro is a popular WordPress plugin used to create and manage online courses and learning management systems. A critical security flaw allows unauthenticated attackers to interact directly with the website's database without needing a login. This could lead to the theft of sensitive student and instructor information, or disruption of the learning platform's operations.

Vendors: [Themeum](https://junglewise.ai/threats/vendors/themeum).

## Quick answers

**Is CVE-2026-22332 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-22332 being exploited in the wild.

**How severe is CVE-2026-22332?** Critical severity, with a CVSS score of 9.3, published 17 June 2026.

**Which products and versions are affected?** Themeum Tutor LMS Pro <= 3.9.6.

**Is there a fix for CVE-2026-22332?** A patch was published on 2026-01-13: Patch released in version 3.9.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-22332 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-22332?** Check whether you run Themeum Tutor LMS Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in the Tutor LMS Pro plugin for WordPress due to improper neutralization of special elements used in an SQL command (CWE-89). The flaw is accessible to unauthenticated remote attackers, meaning no valid user account or special privileges are required to trigger the exploit. By sending specially crafted requests to the affected site, an attacker can execute arbitrary SQL queries against the backend database. This can result in the unauthorized extraction of sensitive data, such as user credentials and personal information, or limited impact on database availability. The issue is resolved in version 3.9.7.

## Affected products

- Themeum Tutor LMS Pro <= 3.9.6

## Timeline

- 2025-09-27: other: Reported by researcher 0xd4rk5id3
- 2026-01-13: advisory: Initial Patchstack advisory published
- 2026-06-17: disclosed: CVE published to NVD
- 2026-01-13: patched: Patch released in version 3.9.7

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/tutor-pro/vulnerability/wordpress-tutor-lms-pro-plugin-3-8-3-sql-injection-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/tutor-pro/vulnerability/wordpress-tutor-lms-pro-plugin-3-8-3-sql-injection-vulnerability?_s_id=cve)