The Tutor LMS WordPress plugin accepts the parameters 'offset' and 'item_per_page' without proper validation, allowing an attacker to inject unsanitized SQL into a database query. The injected text is interpreted as command grammar rather than data, so while arbitrary data extraction is not possible on the tested database engines, the query can be manipulated to reveal question and answer content from courses that are not publicly accessible, resulting in unwanted information disclosure for those courses.

The vulnerability affects all installations of the Tutor LMS plugin for WordPress with versions earlier than 4.0.6. The vendor identifier is Unknown:Tutor LMS and the affected component is the WordPress plugin component. No specific component sub‑versions are listed beyond the general <4.0.6 boundary.

The attack requires a web request that can supply the vulnerable parameters, which is typically achieved through an HTTP GET or POST. Because no authentication is required, any user on the Internet can exploit the flaw. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalogue, but the nature of the flaw—unauthenticated SQL injection—suggests a moderate to high exploitation risk, especially in environments where non‑public courses contain sensitive data.