The vulnerability resides in the Tutor LMS plugin for WordPress and is caused by insufficient escaping of the 'coupon_code' input. The flaw allows an attacker with administrator or higher privileges to append arbitrary SQL to existing queries. This can lead to unauthorized extraction of sensitive database contents, such as user details, transaction histories, and course data. The weakness is categorized as a classic SQL injection (CWE‑89).

All installations of Tutor LMS up to and including version 4.0.1, provided by Themeum, a WordPress eLearning plugin. The issue affects any site running that plugin version regardless of other WordPress components.

The CVSS score of 4.9 indicates moderate impact in the current context, but the requirement for administrator authentication reduces the attack surface. The EPSS score of less than 1% reflects a low likelihood of widespread exploitation as of the latest data, and the vulnerability is not listed in CISA’s KEV catalog. However, because it permits data extraction from the database, the risk to confidentiality remains significant for sites where an administrator account could be compromised or misused.