CVE-2026-6080: Improper Neutralization of Special Elements used in an SQL Command

The Tutor LMS plugin for WordPress is vulnerable to SQL Injection in versions up to and including 3.9.8. This is due to insufficient escaping on the 'date' parameter combined with direct interpolation into a SQL fragment before being passed to $wpdb-prepare. This makes it possible for authenticat...

PT-2024-16241

Name of the Vulnerable Software and Affected Versions Tutor LMS plugin for WordPress versions up to, and including, 2.7.6 Description The issue is due to a missing check for the users can register option in the register instructor function, allowing unauthenticated attackers to register as the...

CVE-2024-10400: Improper Neutralization of Special Elements used in an SQL Command

The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via the ‘ratingfilter’ parameter in all versions up to, and including, 2.7.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

PT-2024-30360

Name of the Vulnerable Software and Affected Versions Tutor LMS plugin for WordPress versions up to, and including, 2.7.0 Description The issue allows authenticated attackers with Instructor-level permissions and above to perform time-based SQL Injection via the question id parameter due to...