CVE-2025-13673: Tutor LMS WordPress Plugin SQLi Vulnerability

CVE-2025-13673 Overview

The Tutor LMS – eLearning and online course solution plugin for WordPress contains a SQL Injection vulnerability in all versions up to and including 3.9.6. The vulnerability exists in the coupon_code parameter due to insufficient escaping of user-supplied input and lack of proper preparation on the existing SQL query. This flaw allows unauthenticated attackers to append additional SQL queries into existing queries, potentially enabling extraction of sensitive information from the database.

Critical Impact
Unauthenticated attackers can exploit this SQL injection vulnerability to extract sensitive data from the WordPress database, including user credentials, payment information, and course enrollment data stored by the Tutor LMS plugin.

Affected Products

Tutor LMS WordPress Plugin versions up to and including 3.9.6
Tutor LMS WordPress Plugin versions 3.9.4 and 3.9.5 (partial mitigation applied)
WordPress sites running vulnerable versions of Tutor LMS plugin

Discovery Timeline

2026-02-28 - CVE-2025-13673 published to NVD
2026-03-02 - Last updated in NVD database

Technical Details for CVE-2025-13673

Vulnerability Analysis

This SQL Injection vulnerability (CWE-89) occurs in the coupon validation functionality of the Tutor LMS plugin. When users apply coupon codes during course enrollment or checkout, the coupon_code parameter is passed to the backend for validation. The plugin fails to properly sanitize or escape this user-controlled input before incorporating it into SQL queries, and does not use parameterized queries or prepared statements consistently.

The vulnerability is exploitable over the network without requiring any authentication or user interaction, making it accessible to any remote attacker. Successful exploitation allows attackers to extract confidential data from the database, though it does not permit modification of database records or cause service disruption. The partial mitigations introduced in versions 3.9.4 and 3.9.6 addressed some exploitation vectors but did not fully remediate the underlying issue.

Root Cause

The root cause of this vulnerability is insufficient input validation and improper SQL query construction. The coupon_code parameter is directly concatenated or interpolated into SQL queries without adequate escaping or the use of prepared statements with bound parameters. This violates secure coding practices for database interactions and allows attackers to break out of the intended query structure and inject malicious SQL commands.

Attack Vector

The attack vector for CVE-2025-13673 is network-based and requires no authentication. An attacker can craft a malicious HTTP request containing SQL injection payloads in the coupon_code parameter. When the Tutor LMS plugin processes this request to validate the coupon, the injected SQL is executed against the WordPress database.

A typical attack scenario involves sending specially crafted coupon codes containing SQL metacharacters and injection payloads. The attacker can use techniques such as UNION-based injection, boolean-based blind injection, or time-based blind injection to systematically extract database contents. Targeted data could include WordPress user credentials, email addresses, Tutor LMS student records, payment transaction details, and other sensitive information stored in the database.

Detection Methods for CVE-2025-13673

Indicators of Compromise

Unusual or malformed values in the coupon_code parameter in web server access logs containing SQL syntax elements such as single quotes, UNION, SELECT, or comment sequences
Database query logs showing unexpected queries originating from coupon validation endpoints
Abnormal database read activity or query execution times associated with the Tutor LMS coupon functionality
HTTP requests to coupon-related endpoints with unusually long parameter values or encoded payloads

Detection Strategies

Implement Web Application Firewall (WAF) rules to detect and block common SQL injection patterns in the coupon_code parameter
Enable detailed logging for WordPress and the Tutor LMS plugin to capture all coupon validation requests
Deploy database activity monitoring to identify queries with suspicious patterns or unauthorized data access attempts
Use security scanning tools to proactively identify SQL injection vulnerabilities in WordPress plugin endpoints

Monitoring Recommendations

Monitor web server logs for requests containing SQL injection indicators targeting Tutor LMS endpoints
Configure alerting for database errors or exceptions that may indicate injection attempts
Implement rate limiting on coupon validation endpoints to slow potential automated exploitation
Review database access patterns for anomalies suggesting data exfiltration activity

How to Mitigate CVE-2025-13673

Immediate Actions Required

Update the Tutor LMS plugin to the latest version that fully addresses this vulnerability
If immediate patching is not possible, consider temporarily disabling coupon functionality until the update can be applied
Review database access logs for evidence of exploitation and assess whether sensitive data may have been compromised
Implement WAF rules to filter SQL injection attempts targeting the coupon_code parameter

Patch Information

The vulnerability has been partially mitigated in Tutor LMS versions 3.9.4 and 3.9.6. Administrators should check for and apply the latest available update that fully resolves this issue. The code changes addressing this vulnerability can be reviewed in the WordPress Plugin Changeset. Additional technical analysis is available from the Wordfence Vulnerability Analysis.

Workarounds

Deploy a Web Application Firewall with SQL injection detection rules to filter malicious requests before they reach the application
Temporarily disable or restrict access to coupon code functionality if the plugin cannot be immediately updated
Implement additional input validation at the server or reverse proxy level to reject requests with suspicious coupon code values
Consider restricting access to Tutor LMS checkout and enrollment pages to authenticated users only as a temporary measure

bash

# Example WAF rule pattern for blocking SQL injection in coupon_code
# Add to .htaccess or WAF configuration
RewriteEngine On
RewriteCond %{QUERY_STRING} coupon_code=.*(\%27|\'|--|\%23|#|union|select|insert|drop|delete|update|exec|script) [NC]
RewriteRule .* - [F,L]