CVE-2026-15444 Overview
CVE-2026-15444 is a SQL injection vulnerability in the Tutor LMS eLearning and online course solution plugin for WordPress. The flaw affects all versions up to and including 4.0.1 and stems from insufficient escaping of the coupon_code parameter combined with inadequate query preparation. Authenticated attackers with administrator-level access or above can append additional SQL statements to existing queries and extract sensitive database contents. The issue is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).
Critical Impact
Authenticated administrators can execute arbitrary SQL queries against the WordPress database through the coupon code handler, exposing user credentials, session tokens, and other sensitive stored data.
Affected Products
- Tutor LMS – eLearning and online course solution plugin for WordPress (all versions ≤ 4.0.1)
- WordPress sites with Tutor LMS eCommerce coupon functionality enabled
- Deployments where administrator accounts are shared or delegated to untrusted operators
Discovery Timeline
- 2026-07-28 - CVE-2026-15444 published to NVD
- 2026-07-28 - Last updated in NVD database
Technical Details for CVE-2026-15444
Vulnerability Analysis
The vulnerability resides in the coupon handling logic of the Tutor LMS plugin. When an administrator submits a coupon operation, the coupon_code parameter is passed through the plugin's input pipeline (classes/Input.php) into the coupon controller (ecommerce/CouponController.php) and ultimately reaches the coupon model and query helper (models/CouponModel.php, helpers/QueryHelper.php). At those layers, the value is concatenated into an SQL statement without being run through a prepared statement or sufficient escaping. An attacker can therefore append arbitrary SQL clauses to the original query. Because the exploit requires administrator privileges, it primarily enables lateral data extraction, privilege abuse in multi-admin environments, and post-compromise persistence rather than initial access.
Root Cause
The root cause is a failure to use parameterized queries when handling the coupon_code value. The plugin relies on custom input handling rather than delegating to $wpdb->prepare() with proper placeholder binding, allowing metacharacters in the coupon string to alter query structure.
Attack Vector
Exploitation occurs over the network against the WordPress administrative interface. An authenticated user holding administrator or higher privileges submits a crafted coupon_code value containing SQL syntax. The injected payload is appended to the original query executed by the coupon model, permitting the attacker to read arbitrary rows from the database, including WordPress wp_users credentials, secret keys, and student or order records managed by Tutor LMS.
No verified public exploit code is available. See the Wordfence Vulnerability Analysis and the WordPress Tutor Coupon Model source reference for the affected code path.
Detection Methods for CVE-2026-15444
Indicators of Compromise
- Requests to Tutor LMS coupon endpoints containing SQL metacharacters such as ', --, UNION SELECT, or SLEEP( in the coupon_code parameter
- Unexpected SELECT queries against wp_users, wp_usermeta, or wp_options originating from PHP-FPM workers handling Tutor LMS requests
- Administrator sessions issuing repeated coupon validation or application requests in rapid succession
- Web server access logs showing long or URL-encoded coupon parameter values from a single administrator account
Detection Strategies
- Enable MySQL general query logging or slow query logging temporarily and search for coupon-driven queries that contain multiple statements or nested SELECT clauses
- Deploy WordPress-aware web application firewall rules that inspect POST bodies to Tutor LMS coupon routes for SQL syntax
- Correlate administrator authentication events with subsequent coupon administration activity to detect abuse of privileged accounts
Monitoring Recommendations
- Alert on any modification to Tutor LMS plugin files outside of a scheduled patch window
- Monitor for creation of new administrator accounts or changes to user_pass hashes shortly after coupon endpoint activity
- Track outbound HTTP traffic from the web host that could indicate exfiltration of query results
How to Mitigate CVE-2026-15444
Immediate Actions Required
- Update the Tutor LMS plugin to a version later than 4.0.1 that incorporates the fix from the WordPress Tutor Changeset Update
- Audit the WordPress administrator role membership and remove any accounts that do not require full administrative privileges
- Rotate WordPress secret keys in wp-config.php and reset administrator passwords if compromise is suspected
Patch Information
The upstream fix is committed in the Tutor LMS repository as changeset 3618540, which updates the coupon handling code in models/CouponModel.php and helpers/QueryHelper.php to use prepared statements. Site operators should install the corresponding release from the WordPress.org plugin directory. Review the WordPress Tutor Query Helper source to confirm the patched query construction pattern.
Workarounds
- Restrict access to /wp-admin/ to a known IP allowlist at the web server or WAF layer until the plugin is updated
- Temporarily disable the Tutor LMS eCommerce coupon feature if it is not in active use
- Enforce multi-factor authentication on all administrator accounts to reduce the risk of privileged credential misuse
# Configuration example: update Tutor LMS via WP-CLI on the WordPress host
wp plugin update tutor --version=<patched-version>
wp plugin get tutor --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
