CVE-2025-13673: Tutor LMS WordPress Plugin SQLi Vulnerability

CVE-2025-13673 Overview

The Tutor LMS – eLearning and online course solution plugin for WordPress contains a SQL Injection vulnerability in all versions up to and including 3.9.6. The vulnerability exists in the coupon_code parameter due to insufficient escaping of user-supplied input and lack of proper preparation on the existing SQL query. This flaw allows unauthenticated attackers to append additional SQL queries into existing queries, potentially enabling extraction of sensitive information from the database.

Critical Impact

Unauthenticated attackers can exploit this SQL injection vulnerability to extract sensitive data from the WordPress database, including user credentials, payment information, and course enrollment data stored by the Tutor LMS plugin.

Affected Products

• Tutor LMS WordPress Plugin versions up to and including 3.9.6
• Tutor LMS WordPress Plugin versions 3.9.4 and 3.9.5 (partial mitigation applied)
• WordPress sites running vulnerable versions of Tutor LMS plugin

Discovery Timeline

• 2026-02-28 - CVE-2025-13673 published to NVD
• 2026-03-02 - Last updated in NVD database

Technical Details for CVE-2025-13673

Vulnerability Analysis

This SQL Injection vulnerability (CWE-89) occurs in the coupon validation functionality of the Tutor LMS plugin. When users apply coupon codes during course enrollment or checkout, the coupon_code parameter is passed to the backend for validation. The plugin fails to properly sanitize or escape this user-controlled input before incorporating it into SQL queries, and does not use parameterized queries or prepared statements consistently.

The vulnerability is exploitable over the network without requiring any authentication or user interaction, making it accessible to any remote attacker. Successful exploitation allows attackers to extract confidential data from the database, though it does not permit modification of database records or cause service disruption. The partial mitigations introduced in versions 3.9.4 and 3.9.6 addressed some exploitation vectors but did not fully remediate the underlying issue.

Root Cause

The root cause of this vulnerability is insufficient input validation and improper SQL query construction. The coupon_code parameter is directly concatenated or interpolated into SQL queries without adequate escaping or the use of prepared statements with bound parameters. This violates secure coding practices for database interactions and allows attackers to break out of the intended query structure and inject malicious SQL commands.

Attack Vector

The attack vector for CVE-2025-13673 is network-based and requires no authentication. An attacker can craft a malicious HTTP request containing SQL injection payloads in the coupon_code parameter. When the Tutor LMS plugin processes this request to validate the coupon, the injected SQL is executed against the WordPress database.

A typical attack scenario involves sending specially crafted coupon codes containing SQL metacharacters and injection payloads. The attacker can use techniques such as UNION-based injection, boolean-based blind injection, or time-based blind injection to systematically extract database contents. Targeted data could include WordPress user credentials, email addresses, Tutor LMS student records, payment transaction details, and other sensitive information stored in the database.

Detection Methods for CVE-2025-13673

Indicators of Compromise

• Unusual or malformed values in the coupon_code parameter in web server access logs containing SQL syntax elements such as single quotes, UNION, SELECT, or comment sequences
• Database query logs showing unexpected queries originating from coupon validation endpoints
• Abnormal database read activity or query execution times associated with the Tutor LMS coupon functionality
• HTTP requests to coupon-related endpoints with unusually long parameter values or encoded payloads

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block common SQL injection patterns in the coupon_code parameter
• Enable detailed logging for WordPress and the Tutor LMS plugin to capture all coupon validation requests
• Deploy database activity monitoring to identify queries with suspicious patterns or unauthorized data access attempts
• Use security scanning tools to proactively identify SQL injection vulnerabilities in WordPress plugin endpoints

Monitoring Recommendations

• Monitor web server logs for requests containing SQL injection indicators targeting Tutor LMS endpoints
• Configure alerting for database errors or exceptions that may indicate injection attempts
• Implement rate limiting on coupon validation endpoints to slow potential automated exploitation
• Review database access patterns for anomalies suggesting data exfiltration activity

How to Mitigate CVE-2025-13673

Immediate Actions Required

• Update the Tutor LMS plugin to the latest version that fully addresses this vulnerability
• If immediate patching is not possible, consider temporarily disabling coupon functionality until the update can be applied
• Review database access logs for evidence of exploitation and assess whether sensitive data may have been compromised
• Implement WAF rules to filter SQL injection attempts targeting the coupon_code parameter

Patch Information

The vulnerability has been partially mitigated in Tutor LMS versions 3.9.4 and 3.9.6. Administrators should check for and apply the latest available update that fully resolves this issue. The code changes addressing this vulnerability can be reviewed in the WordPress Plugin Changeset. Additional technical analysis is available from the Wordfence Vulnerability Analysis.

Workarounds

• Deploy a Web Application Firewall with SQL injection detection rules to filter malicious requests before they reach the application
• Temporarily disable or restrict access to coupon code functionality if the plugin cannot be immediately updated
• Implement additional input validation at the server or reverse proxy level to reject requests with suspicious coupon code values
• Consider restricting access to Tutor LMS checkout and enrollment pages to authenticated users only as a temporary measure

# Example WAF rule pattern for blocking SQL injection in coupon_code
# Add to .htaccess or WAF configuration
RewriteEngine On
RewriteCond %{QUERY_STRING} coupon_code=.*(\%27|\'|--|\%23|#|union|select|insert|drop|delete|update|exec|script) [NC]
RewriteRule .* - [F,L]