CVE-2026-6080: Tutor LMS <= 3.9.8 - Authenticated (Admin+) SQL Injection via 'date' Parameter
The Tutor LMS plugin for WordPress is vulnerable to SQL Injection in versions up to and including 3.9.8. This is due to insufficient escaping on the 'date' parameter combined with direct interpolation into a SQL fragment before being passed to $wpdb->prepare(). This makes it possible for authenticated attackers with Admin-level access and above to append additional SQL queries and extract sensitive information from the database.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Tutor LMS pluginto a version that resolves this vulnerability.Fixed in 3.9.8
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6080?
CVE-2026-6080 is considered a high severity vulnerability due to its potential impact on database security through SQL injection.
How do I fix CVE-2026-6080?
To fix CVE-2026-6080, update the Tutor LMS plugin to version 3.9.9 or later.
What kind of vulnerability is CVE-2026-6080?
CVE-2026-6080 is an SQL injection vulnerability that allows an attacker to interfere with the queries made to the database.
Who is affected by CVE-2026-6080?
Users of the Tutor LMS plugin for WordPress, specifically those using version 3.9.8 or earlier, are affected by CVE-2026-6080.
What can an attacker do with CVE-2026-6080?
An attacker exploiting CVE-2026-6080 could potentially read sensitive data from the database or manipulate database content.