CVE-2026-22332: Tutor LMS Pro SQLi Vulnerability

CVE-2026-22332 Overview

CVE-2026-22332 is an unauthenticated SQL Injection vulnerability affecting Tutor LMS Pro, a commercial WordPress learning management system plugin. The flaw is present in versions up to and including 3.9.6. Remote attackers can inject crafted SQL statements through plugin input handlers without prior authentication. Successful exploitation enables manipulation of the underlying database used by the WordPress site. The weakness is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Unauthenticated attackers can query and manipulate the WordPress database of any site running a vulnerable Tutor LMS Pro instance, potentially exposing user records and course data.

Affected Products

Tutor LMS Pro plugin for WordPress, versions <= 3.9.6
WordPress sites with the vulnerable Tutor LMS Pro plugin installed and active
Hosting environments serving WordPress with the affected commercial plugin

Discovery Timeline

2026-06-17 - CVE-2026-22332 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-22332

Vulnerability Analysis

The vulnerability resides in Tutor LMS Pro request handlers that build SQL statements using attacker-controlled input. The plugin fails to sanitize or parameterize values before concatenating them into queries executed against the WordPress database. Because the affected entry point does not enforce authentication, any anonymous visitor can submit crafted parameters. The scope is changed, meaning a successful injection can affect resources beyond the vulnerable plugin context, including core WordPress tables such as wp_users and wp_usermeta. Confidentiality impact is high, while availability impact is low and integrity is unaffected per the published vector. The EPSS probability is 0.283% at the 19.8 percentile, indicating low observed exploitation likelihood at publication.

Root Cause

The root cause is improper neutralization of special characters in SQL statements [CWE-89]. The plugin concatenates user-supplied request parameters directly into database queries without using prepared statements or wpdb::prepare() placeholders. This pattern allows attackers to break out of the intended query context and append arbitrary SQL clauses.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker sends an HTTP request to a vulnerable endpoint exposed by Tutor LMS Pro on the target WordPress site. The injected SQL payload is interpreted by the database, allowing extraction of sensitive data or further query manipulation.

No verified public proof-of-concept code is available. Refer to the Patchstack SQL Injection Advisory for additional technical context.

Detection Methods for CVE-2026-22332

Indicators of Compromise

HTTP requests to Tutor LMS Pro plugin endpoints containing SQL meta-characters such as ', --, UNION SELECT, SLEEP(, or INFORMATION_SCHEMA
Unexpected outbound queries from the WordPress database user or anomalous read access to wp_users and wp_usermeta tables
Web server logs showing unauthenticated POST or GET traffic to Tutor LMS Pro AJAX or REST routes with unusually long query strings

Detection Strategies

Inspect WordPress access logs for parameter values containing SQL keywords directed at Tutor LMS Pro routes under /wp-admin/admin-ajax.php or /wp-json/tutor/
Enable verbose database query logging on staging or canary nodes to identify malformed statements originating from plugin handlers
Deploy Web Application Firewall (WAF) rules that flag boolean-based, time-based, and union-based SQL injection signatures against plugin endpoints

Monitoring Recommendations

Alert on spikes in 500-series HTTP responses or database errors emitted by wp-content/plugins/tutor-pro/
Monitor for new or unexpected administrator accounts and password resets following anonymous traffic bursts
Track plugin version inventory across WordPress fleets to identify hosts still running Tutor LMS Pro <= 3.9.6

How to Mitigate CVE-2026-22332

Immediate Actions Required

Update Tutor LMS Pro to a version later than 3.9.6 as soon as the vendor-supplied patched release is available
Restrict access to the WordPress site from untrusted networks until patching is complete
Audit wp_users, wp_usermeta, and course-related tables for unauthorized modifications

Patch Information

Review the Patchstack SQL Injection Advisory for the fixed version and vendor remediation guidance. Apply the patched Tutor LMS Pro release through the WordPress plugin updater or by replacing plugin files manually from the vendor portal.

Workarounds

Deactivate and remove Tutor LMS Pro on affected sites until a patched version is deployed
Configure a WAF rule set, such as Patchstack or an equivalent virtual patching service, to block known SQL injection payloads targeting Tutor LMS Pro endpoints
Apply least-privilege database credentials to the WordPress site so the database user cannot read or alter tables outside the plugin scope

bash

# Configuration example: identify vulnerable Tutor LMS Pro installations
wp plugin list --field=name,version | grep -i tutor-pro
# Disable the plugin until patched
wp plugin deactivate tutor-pro