Medium severity6.5NVD Advisory· Published Apr 17, 2026· Updated Apr 22, 2026
CVE-2026-6080
CVE-2026-6080
Description
The Tutor LMS plugin for WordPress is vulnerable to SQL Injection in versions up to and including 3.9.8. This is due to insufficient escaping on the 'date' parameter combined with direct interpolation into a SQL fragment before being passed to $wpdb->prepare(). This makes it possible for authenticated attackers with Admin-level access and above to append additional SQL queries and extract sensitive information from the database.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
8- plugins.trac.wordpress.org/browser/tutor/tags/3.9.8/classes/Instructors_List.phpnvd
- plugins.trac.wordpress.org/browser/tutor/tags/3.9.8/classes/Instructors_List.phpnvd
- plugins.trac.wordpress.org/browser/tutor/tags/3.9.8/views/pages/instructors.phpnvd
- plugins.trac.wordpress.org/browser/tutor/trunk/classes/Instructors_List.phpnvd
- plugins.trac.wordpress.org/browser/tutor/trunk/classes/Instructors_List.phpnvd
- plugins.trac.wordpress.org/browser/tutor/trunk/views/pages/instructors.phpnvd
- plugins.trac.wordpress.org/changeset/3505142/tutor/tags/3.9.9/classes/Instructors_List.phpnvd
- www.wordfence.com/threat-intel/vulnerabilities/id/6dd041ff-a0a3-4d1f-83e0-6ec2a978e9cfnvd
News mentions
1- Wordfence Intelligence Weekly WordPress Vulnerability Report (April 13, 2026 to April 19, 2026)Wordfence Blog · Apr 23, 2026