CVE-2026-15444

Name of the Vulnerable Software and Affected Versions Tutor LMS versions prior to 4.0.2

Description The Tutor LMS plugin for WordPress contains a SQL Injection flaw. This occurs because the software does not sufficiently escape the coupon code parameter and fails to properly prepare the associated SQL query. Authenticated attackers with administrator-level access or higher can exploit this by appending malicious SQL queries to existing ones, allowing the extraction of sensitive information from the database.

Recommendations Update the plugin to a version newer than 4.0.1. As a temporary mitigation, restrict the use of the coupon code parameter until the update is applied.