The Tutor LMS eLearning plugin stores quiz answers in a way that allows an authenticated user with custom‑level access or higher to insert arbitrary SQL into a stored array. When the quiz‑attempt details endpoint is later invoked by a privileged user or a REST API key holder, the injected SQL is executed, potentially revealing sensitive database information. This is a data‑exposure vulnerability caused by improper input escaping (CWE‑89).

themeum Tutor LMS – eLearning and online course solution, all plugin releases up to and including version 4.0..

The CVSS score is 6.5, indicating medium severity. The EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting a low current exploitation probability. Exploitation requires authentication with custom‑level or higher access and relies on a second‑order injection chain that triggers only when the privileged endpoint is accessed. The attack vector is inferred to be from authenticated users interacting with the quiz features and then a privileged bypass via the REST API.