Volerion logoVolerion
Volerion logoVolerion

Tutor LMS SQL Injection Vulnerability in WordPress Plugin

Vulnerability

A SQL injection vulnerability has been identified in the Tutor LMS WordPress plugin, specifically in versions 3.9.6 and prior. The issue arises from inadequate escaping of user-supplied data in the 'coupon_code' parameter, allowing unauthenticated attackers to inject additional SQL queries. This exploitation could lead to the unauthorized extraction of sensitive information from the database.

Impact

Exploitation of this vulnerability allows for SQL injection, where attackers can manipulate database queries to access or modify sensitive information.

Remediation

Users are advised to update the Tutor LMS plugin to version 3.9.7 or a newer patched version.

Added: Feb 28, 2026, 8:17 AM
Updated: Feb 28, 2026, 8:17 AM

Vulnerability Rating

Custom Algorithm
spread
5.2
impact
2.5
exploitability
9.0
remediation
7.7
relevance
3.5
threat
3.2
urgency
2.9
incentive
8.3

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.