CVE-2024-4352: Tutor LMS Pro SQL Injection Vulnerability

CVE-2024-4352 Overview

CVE-2024-4352 affects the Tutor LMS Pro plugin for WordPress. The vulnerability combines two flaws in the get_calendar_materials function: a missing capability check [CWE-862] and SQL injection through the year parameter. Authenticated attackers with subscriber-level permissions can append arbitrary SQL to existing queries. Successful exploitation extracts sensitive data from the WordPress database, including credentials, session data, and personally identifiable information stored by the learning management system.

Critical Impact

Authenticated subscribers can extract sensitive database contents through SQL injection, resulting in confidentiality, integrity, and availability loss.

Affected Products

• Themeum Tutor LMS Pro plugin for WordPress
• Deployments exposing subscriber-level registration to untrusted users
• Sites running affected versions with the get_calendar_materials AJAX action enabled

Discovery Timeline

• 2024-05-16 - CVE-2024-4352 published to the National Vulnerability Database (NVD)
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-4352

Vulnerability Analysis

The get_calendar_materials function in Tutor LMS Pro exposes an AJAX endpoint without validating the caller's role. Any authenticated account, including self-registered subscribers, can invoke the function. The endpoint accepts a year parameter and concatenates it into a SQL query without proper escaping or parameterization.

Attackers submit crafted values in the year parameter to append SQL clauses to the existing query. The database returns injected results through the AJAX response, giving attackers a working data extraction channel. Because subscriber registration is often open by default on WordPress LMS sites, the barrier to exploitation is low.

Root Cause

Two weaknesses combine to create the vulnerability. First, the handler for get_calendar_materials lacks a current_user_can capability check, violating WordPress role enforcement guidance. Second, the SQL statement built inside the function relies on unsanitized user input rather than $wpdb->prepare with typed placeholders.

Attack Vector

Exploitation occurs over the network against the WordPress admin-ajax.php or REST endpoint used by Tutor LMS. The attacker authenticates as a subscriber, then sends a request invoking the get_calendar_materials action with a malicious year value. The payload uses standard union-based or time-based SQL injection techniques to enumerate tables and exfiltrate values from wp_users, wp_usermeta, and Tutor LMS course data.

The vulnerability mechanism is documented in the Wordfence Vulnerability Report #C647BEDA. No verified proof-of-concept code is publicly available at time of writing.

Detection Methods for CVE-2024-4352

Indicators of Compromise

• POST requests to admin-ajax.php with action=tutor_get_calendar_materials originating from subscriber accounts
• SQL syntax such as UNION SELECT, SLEEP(, or INFORMATION_SCHEMA appearing in the year request parameter
• Unusual response sizes or elapsed times for calendar material AJAX requests
• Newly created WordPress accounts followed shortly by AJAX activity targeting Tutor LMS endpoints

Detection Strategies

• Inspect web server and PHP-FPM access logs for the get_calendar_materials action combined with non-numeric year values
• Enable MySQL general query logging or slow query logs on staging to identify malformed statements originating from the plugin
• Deploy a Web Application Firewall (WAF) rule that blocks non-integer values in the year parameter of Tutor LMS AJAX calls

Monitoring Recommendations

• Correlate subscriber account creation with subsequent AJAX activity to identify reconnaissance behavior
• Alert on outbound anomalies from the WordPress host that could indicate data staging or exfiltration
• Track the Tutor LMS Pro plugin version across your estate and flag hosts running unpatched builds

How to Mitigate CVE-2024-4352

Immediate Actions Required

• Update Tutor LMS Pro to the latest patched version distributed by Themeum through the plugin's licensed update channel
• Audit WordPress user accounts and remove unrecognized subscriber-level users
• Disable open user registration on sites that do not require it by unchecking Anyone can register under WordPress general settings
• Review database logs and Tutor LMS records for signs of prior exploitation

Patch Information

Themeum addresses the flaw in updated releases of Tutor LMS Pro. Consult the Themeum Tutor LMS product page and your license portal for the current fixed version. Apply the update in staging before promoting to production, and verify the plugin version on every WordPress host.

Workarounds

• Restrict access to admin-ajax.php for the tutor_get_calendar_materials action using a WAF rule until the patch is applied
• Enforce numeric-only validation on the year parameter at the reverse proxy or WAF layer
• Temporarily deactivate Tutor LMS Pro on sites where subscriber registration cannot be disabled and the plugin cannot be updated

# Example ModSecurity rule blocking non-numeric year values
SecRule ARGS:action "@streq tutor_get_calendar_materials" \
    "chain,id:1004352,phase:2,deny,status:403,\
     msg:'CVE-2024-4352 Tutor LMS Pro SQLi attempt'"
    SecRule ARGS:year "!@rx ^[0-9]{4}$" "t:none"