An unauthenticated SQL injection flaw exists in the Tutor LMS – eLearning and online course solution plugin for WordPress. The vulnerability is triggered by the coupon_code parameter, which lacks adequate escaping and statement preparation. By injecting malicious SQL, an attacker could forge additional SQL statements that run against the backend database, potentially causing the extraction of sensitive data such as user credentials, course content, and payment information. The flaw is a classic injection weakness identified as CWE‑89.

All releases of the Tutor LMS plugin up to and including version 3.9.6 are affected. The affected vendor is Themeum, whose Tutor LMS product is widely deployed on WordPress sites for e‑learning and online courses. Despite partial mitigation efforts in versions 3.9.4 and 3.9.6, the flaw remains present through 3.9.6 and any earlier releases.

The CVSS base score of 7.5 marks this issue as high‑severity, with an EPSS score of less than 1 % indicating a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Because the flaw is unauthenticated and can be triggered simply by accessing the coupon_code parameter, attackers could exploit it from any network boundary. In practice, unless mitigated by firewalls or patching, the risk is moderate to high depending on site exposure.