CVE-2026-15022

Name of the Vulnerable Software and Affected Versions Tutor LMS – eLearning and online course solution plugin for WordPress versions prior to 4.0.1

Description An issue exists where authenticated attackers with custom-level access or higher can perform a second-order SQL Injection. This occurs because of insufficient escaping of user-supplied parameters and a lack of preparation in the SQL query. The malicious payload is stored during a quiz attempt via the wp ajax tutor quiz abandon handler. The injection is subsequently executed when a privileged user or a Tutor REST API key holder requests the '/wp-json/tutor/v1/quiz-attempt-details/{id}' endpoint, allowing for the extraction of sensitive information from the database.

Recommendations Update the plugin to a version later than 4.0.0.