The plugin contains a time‑based SQL Injection flaw in the order parameter of the get_submitted_assignments() function. Because the value is concatenated directly into an SQL statement without proper escaping or parameterization, an attacker who can log in as a Tutor Instructor or higher can append malicious SQL to the query. This allows unauthorized extraction of arbitrary data from the database, effectively compromising confidentiality and potentially enabling further exploitation if the database contains sensitive user or system information.

WordPress sites using the Tutor LMS Pro plugin, version 3.7.0 or earlier, including the 3.7.0 release. Only the Pro edition is affected; the free version is not vulnerable.

The CVSS v3 score of 8.8 indicates high severity, while the EPSS score of less than 1% suggests that the likelihood of exploitation is low at the time of this analysis. However, the vulnerability is included for authenticated users with Tutor Instructor+ privileges, a role that many course administrators possess. The flaw is not listed in the CISA KEV catalog, but the nature of the SQL injection remains a critical concern for any site that handles sensitive data through this plugin.