CVE-2026-19094: Tutor LMS WordPress Plugin SQLi Vulnerability

CVE-2026-19094 Overview

CVE-2026-19094 affects the Tutor LMS WordPress plugin in versions prior to 4.0.6. The plugin fails to validate values used to build a database query and does not restrict which template file a request may load. Unauthenticated attackers can inject SQL syntax and read question and answer content belonging to courses that are not publicly available. The injected text reaches the query as grammar rather than as data. On the database engines tested, the flaw does not yield extraction of arbitrary data from the database at large. The confidentiality impact is limited to disclosed course content (CWE-89).

Critical Impact
Unauthenticated remote attackers can disclose private course question and answer content from non-public Tutor LMS courses through SQL grammar injection and unrestricted template loading.

Affected Products

Tutor LMS WordPress plugin versions prior to 4.0.6
WordPress sites running the Tutor LMS plugin with non-public course content
Learning management deployments exposing the vulnerable template loader endpoint

Discovery Timeline

2026-08-26 - CVE-2026-19094 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-19094

Vulnerability Analysis

The vulnerability combines two weaknesses in Tutor LMS. First, the plugin passes user-supplied values into a database query without proper validation or parameterization. Second, the request handler that loads template files does not restrict which template a caller may request. An unauthenticated attacker can chain these flaws to influence query grammar and to force the plugin to render templates that expose otherwise restricted question and answer content.

The injected input reaches the SQL parser as syntax rather than as bound parameter data. On the database backends tested by the reporter, this does not permit arbitrary data extraction across tables. The realized impact is disclosure of course-related content that the plugin protects behind access controls under normal use.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command, classified under CWE-89. The plugin builds queries by concatenating attacker-controlled values rather than binding them as parameters. A parallel access control weakness in the template loader compounds the issue by allowing any caller to request template files that surface protected content.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends crafted HTTP requests to the vulnerable Tutor LMS endpoints. The request supplies SQL grammar in a parameter that reaches the query builder and specifies a template file that renders the protected question and answer content in the response.

No verified public exploit code is available at this time. Refer to the WPScan Vulnerability Report #8830 for the reporter's technical analysis.

Detection Methods for CVE-2026-19094

Indicators of Compromise

HTTP requests to Tutor LMS endpoints containing SQL metacharacters such as single quotes, UNION, SELECT, or comment sequences in query parameters
Requests referencing template file names in parameters targeting the plugin's template loading handler
Unauthenticated access patterns retrieving question and answer content tied to non-public course identifiers

Detection Strategies

Inspect WordPress and web server access logs for anomalous parameter values sent to Tutor LMS routes and AJAX actions
Deploy web application firewall rules that match SQL injection payload patterns against plugin endpoints
Correlate template loader requests with the requesting session's authentication state to flag unauthenticated template access

Monitoring Recommendations

Alert on repeated 200 responses to unauthenticated Tutor LMS endpoints returning course content payloads
Baseline normal query patterns against the WordPress database and flag queries containing untypical grammar constructs originating from the plugin
Track plugin version inventory across WordPress deployments to identify hosts running Tutor LMS below 4.0.6

How to Mitigate CVE-2026-19094

Immediate Actions Required

Upgrade the Tutor LMS plugin to version 4.0.6 or later on all WordPress installations
Audit access logs for suspicious requests to Tutor LMS endpoints since the plugin was installed
Restrict administrative and course management endpoints behind IP allowlists where feasible until patching is complete

Patch Information

The vendor has released Tutor LMS 4.0.6, which addresses input validation for database queries and restricts template file loading. Update through the WordPress plugin dashboard or by replacing the plugin files with the fixed release. See the WPScan Vulnerability Report #8830 for reference details.

Workarounds

Disable the Tutor LMS plugin until an upgrade to 4.0.6 or later can be applied
Apply web application firewall signatures that block SQL metacharacters and template path parameters on Tutor LMS routes
Limit exposure of non-public courses by removing sensitive question and answer content from production until patching is verified

bash

# Configuration example
# Update Tutor LMS via WP-CLI to the fixed release
wp plugin update tutor --version=4.0.6
wp plugin get tutor --field=version