CVE-2024-1751: Themeum Tutor LMS SQLi Vulnerability

CVE-2024-1751 Overview

CVE-2024-1751 is a time-based SQL injection vulnerability in the Tutor LMS – eLearning and online course solution plugin for WordPress. The flaw affects all versions up to and including 2.6.1. It exists in the handling of the question_id parameter, where insufficient escaping and improper query preparation allow authenticated attackers to inject SQL into existing database queries. Attackers with subscriber or student level access can exploit this weakness to extract sensitive information from the WordPress database. The vulnerability is tracked under [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Authenticated users with minimal privileges can extract sensitive data, including credentials and personally identifiable information, from the WordPress database.

Affected Products

Themeum Tutor LMS plugin for WordPress (all versions ≤ 2.6.1)
WordPress sites running the eLearning and online course solution plugin
Learning management deployments accepting subscriber or student registrations

Discovery Timeline

2024-03-13 - CVE-2024-1751 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1751

Vulnerability Analysis

The vulnerability resides in the Tutor LMS plugin's handling of question-related database operations. The question_id parameter flows into an SQL query without adequate sanitization or use of prepared statements. Attackers append additional SQL clauses to the existing query, extending its logic beyond the developer's intent.

Because the injection is time-based, attackers infer data by measuring server response delays triggered by conditional SLEEP() operations. This blind extraction technique bypasses the need for direct output, allowing systematic exfiltration of data character by character. The Wordfence Vulnerability Report documents the flaw and its remediation.

Root Cause

The root cause is a failure to properly escape user-supplied input and prepare the SQL query. The plugin concatenates the question_id value into a query string rather than binding it as a parameter. The affected code path is documented in the WordPress Tutor Utils Code at line 4555 of classes/Utils.php.

Attack Vector

Exploitation requires an authenticated account with subscriber or student privileges, which are typically self-registerable on eLearning sites. The attacker submits a crafted question_id value to the vulnerable endpoint over the network. The malicious payload extends the underlying SQL query with time-delay functions or UNION clauses to enumerate database contents. No user interaction is required beyond the attacker's own authenticated session.

The vulnerability manifests when unsanitized input is concatenated into the SQL query executed against the WordPress database. See the WordPress Tutor Changeset for the corresponding fix committed by the plugin maintainers.

Detection Methods for CVE-2024-1751

Indicators of Compromise

Web server access logs containing question_id parameters with SQL keywords such as SLEEP, BENCHMARK, UNION, or SELECT
Unusually long response times on Tutor LMS AJAX endpoints correlated with authenticated subscriber sessions
Repeated requests from a single authenticated user against question-related handlers within a short window
Database query logs showing malformed or extended queries originating from Tutor LMS functions

Detection Strategies

Deploy a web application firewall rule that inspects the question_id parameter for non-numeric content
Enable MySQL slow query logging to surface abnormally long queries generated by injection payloads
Correlate authentication events for low-privilege accounts with spikes in Tutor LMS endpoint traffic
Review WordPress audit logs for newly registered subscriber accounts followed by immediate access to plugin endpoints

Monitoring Recommendations

Baseline normal request patterns for Tutor LMS AJAX handlers and alert on statistical deviations
Monitor database CPU utilization and query duration metrics for time-based injection signatures
Track failed and successful login attempts to identify credential stuffing preceding exploitation

How to Mitigate CVE-2024-1751

Immediate Actions Required

Update the Tutor LMS plugin to a version newer than 2.6.1 that includes the fix from the referenced changeset
Audit all subscriber and student accounts, removing any that appear unauthorized or inactive
Restrict self-registration on WordPress sites that do not require open enrollment
Review database logs and user tables for evidence of prior data extraction

Patch Information

Themeum addressed the flaw by adding proper input escaping and parameter preparation to the vulnerable query. The corrective code is available in the WordPress Tutor Changeset. Site administrators should apply the update through the WordPress plugin dashboard or via WP-CLI.

Workarounds

Disable the Tutor LMS plugin until patching is possible if immediate updates cannot be applied
Deploy a WAF ruleset that blocks SQL metacharacters in the question_id parameter
Temporarily disable new user registration or require administrator approval for subscriber accounts
Restrict access to Tutor LMS endpoints via IP allowlisting where feasible

bash

# Update Tutor LMS via WP-CLI to the latest patched release
wp plugin update tutor --path=/var/www/html

# Verify the installed version post-update
wp plugin get tutor --field=version --path=/var/www/html