Medium severity6.5NVD Advisory· Published Apr 17, 2026· Updated Apr 22, 2026
CVE-2026-6080
CVE-2026-6080
Description
The Tutor LMS plugin for WordPress is vulnerable to SQL Injection in versions up to and including 3.9.8. This is due to insufficient escaping on the 'date' parameter combined with direct interpolation into a SQL fragment before being passed to $wpdb->prepare(). This makes it possible for authenticated attackers with Admin-level access and above to append additional SQL queries and extract sensitive information from the database.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2Patches
Vulnerability mechanics
References
8- plugins.trac.wordpress.org/browser/tutor/tags/3.9.8/classes/Instructors_List.phpnvd
- plugins.trac.wordpress.org/browser/tutor/tags/3.9.8/classes/Instructors_List.phpnvd
- plugins.trac.wordpress.org/browser/tutor/tags/3.9.8/views/pages/instructors.phpnvd
- plugins.trac.wordpress.org/browser/tutor/trunk/classes/Instructors_List.phpnvd
- plugins.trac.wordpress.org/browser/tutor/trunk/classes/Instructors_List.phpnvd
- plugins.trac.wordpress.org/browser/tutor/trunk/views/pages/instructors.phpnvd
- plugins.trac.wordpress.org/changeset/3505142/tutor/tags/3.9.9/classes/Instructors_List.phpnvd
- www.wordfence.com/threat-intel/vulnerabilities/id/6dd041ff-a0a3-4d1f-83e0-6ec2a978e9cfnvd
News mentions
1- Wordfence Intelligence Weekly WordPress Vulnerability Report (April 13, 2026 to April 19, 2026)Wordfence Blog · Apr 23, 2026