CVE-2024-10400 Overview
CVE-2024-10400 is an unauthenticated SQL Injection vulnerability in the Tutor LMS plugin for WordPress. The flaw affects all versions up to and including 2.7.6. It resides in the handling of the rating_filter parameter, where user input is concatenated into SQL queries without sufficient escaping or prepared statements [CWE-89]. Attackers can append arbitrary SQL clauses to existing queries and extract sensitive data from the WordPress database. The vulnerability is network-accessible, requires no authentication, and no user interaction.
Critical Impact
Unauthenticated remote attackers can exfiltrate user credentials, session tokens, and personally identifiable information from any WordPress site running a vulnerable Tutor LMS installation.
Affected Products
- Themeum Tutor LMS plugin for WordPress, all versions up to and including 2.7.6
- WordPress sites exposing the plugin's rating_filter query parameter
- Course and learning management deployments built on Tutor LMS
Discovery Timeline
- 2024-11-21 - CVE-2024-10400 published to the National Vulnerability Database
- 2025-01-23 - Last updated in NVD database
Technical Details for CVE-2024-10400
Vulnerability Analysis
The vulnerability is a classic SQL Injection issue [CWE-89] triggered through the rating_filter request parameter. Tutor LMS uses this parameter when filtering course reviews and ratings. The plugin inserts the value directly into a SQL query string instead of binding it through $wpdb->prepare() with safe placeholders.
Because the input is not escaped or validated, an attacker can break out of the intended SQL context. Injected payloads can append UNION SELECT statements that read arbitrary tables, including wp_users and wp_usermeta. The Exploit Prediction Scoring System places this issue in the top tier of actively targeted vulnerabilities, reflecting how trivially WordPress SQLi flaws are weaponized at scale.
Root Cause
The root cause is insufficient sanitization combined with absent query parameterization. The plugin trusts the rating_filter value supplied by unauthenticated HTTP clients. WordPress provides $wpdb->prepare() with %s and %d placeholders specifically to prevent this pattern, but the vulnerable code path does not use them on this input.
Attack Vector
Exploitation requires only an HTTP request to a public Tutor LMS endpoint that processes the rating_filter parameter. No account, role, or prior access is needed. Attackers typically use time-based or UNION-based payloads to enumerate database schema, then extract administrator password hashes and session tokens. See the Wordfence Vulnerability Report for additional technical analysis.
Detection Methods for CVE-2024-10400
Indicators of Compromise
- HTTP requests containing the rating_filter parameter with SQL keywords such as UNION, SELECT, SLEEP(, BENCHMARK(, or encoded variants
- Web server access logs showing unusually long response times on Tutor LMS endpoints, suggesting time-based blind SQLi
- Outbound database queries against wp_users, wp_usermeta, or wp_options from frontend request contexts
- New or unexpected administrator accounts created in WordPress following anomalous request bursts
Detection Strategies
- Inspect web application firewall and reverse proxy logs for SQL metacharacters in the rating_filter parameter value
- Hunt for repeated requests to Tutor LMS rating and course endpoints from a single source IP within a short window
- Correlate database error messages in debug.log with inbound HTTP request IDs to identify probing attempts
Monitoring Recommendations
- Enable WordPress query logging or database audit logging for SELECT statements that reference authentication tables from non-admin contexts
- Alert on any 500-series responses originating from the Tutor LMS plugin path
- Track plugin version inventory across WordPress fleets to flag installations at or below version 2.7.6
How to Mitigate CVE-2024-10400
Immediate Actions Required
- Upgrade Tutor LMS to a version newer than 2.7.6 on every WordPress site in scope
- Audit wp_users for unauthorized accounts and force password resets for all administrators if exposure is suspected
- Rotate WordPress secret keys in wp-config.php and invalidate active sessions
- Review database access logs for evidence of data exfiltration during the exposure window
Patch Information
Themeum addressed the vulnerability in the Tutor LMS source tree. The fix introduces proper escaping and prepared statements for the rating_filter parameter. Review the official patch in the WordPress Plugin Changeset and apply the corresponding plugin update through the WordPress admin dashboard or wp-cli.
Workarounds
- Deploy a web application firewall rule that blocks requests where rating_filter contains SQL metacharacters such as quotes, semicolons, or UNION
- Temporarily deactivate the Tutor LMS plugin on internet-facing sites that cannot be patched immediately
- Restrict access to course rating endpoints to authenticated users via reverse proxy access control lists
# Update Tutor LMS to the patched version using wp-cli
wp plugin update tutor --version=2.7.7
wp plugin list --name=tutor --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
