CVE-2026-22332: WordPress Tutor LMS Pro plugin <= 3.9.6 - SQL Injection vulnerability

Synopsis

An unauthenticated SQL injection vulnerability affects the Tutor LMS Pro WordPress plugin at version 3.9.6 and below. The flaw is reachable over the network with no login or special account required, meaning any internet-accessible WordPress site running the affected plugin is exposed. Successful exploitation gives an attacker read access to the underlying database and limited ability to disrupt service availability. HarborGuard is tracking the advisory for patch availability and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the WordPress site's HTTP interface, typically meaning any publicly routable site is at risk.

• AuthenticationNot required

  No account or session credential of any kind is needed; the injection point is reachable by anonymous HTTP requests.

• Victim interactionNot required

  Exploitation is fully server-side and requires no action from any logged-in user or administrator.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other environmental factors.

Blast Radius

• An attacker can read arbitrary rows from the WordPress database, including stored user credentials (hashed passwords), email addresses, session tokens, and plugin configuration data.
• The scope of the SQL injection crosses the affected component boundary (CVSS Scope: Changed), so database content beyond the plugin's own tables may be accessible depending on the database user's privileges.
• Service availability is partially affected; malformed or resource-intensive queries can degrade or interrupt database responsiveness for the WordPress installation.