SQL Injection Vulnerability in Tutor LMS Plugin for WordPress
CVE-2026-19094
Key Information:
Badges
What is CVE-2026-19094?
The Tutor LMS plugin for WordPress prior to version 4.0.6 is susceptible to an SQL injection vulnerability. This issue arises due to inadequate validation of values used in constructing database queries. It allows unauthenticated users to manipulate queries to extract sensitive information, specifically question and answer content associated with courses that are not publicly accessible. The vulnerability pertains to the processing of input, where maliciously crafted data can be injected, impacting the confidentiality of course resources.
Affected Version(s)
Tutor LMS 4.0.0 < 4.0.6
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.