The Tutor LMS plugin for WordPress contains an SQL injection flaw that allows an authenticated attacker with Administrator or higher privileges to inject additional SQL statements via the 'date' URL parameter. The vulnerability arises because the parameter is not properly escaped before being concatenated into a SQL fragment passed to $wpdb->prepare(), enabling arbitrary query execution. This flaw can result in the theft of sensitive database contents, such as user data and course information, while leaving system integrity and availability largely intact.

The affected product is Tutor LMS, developed by themeum, for WordPress sites. Versions up to and including 3.9.8 are impacted. Users running those or earlier releases of the plugin should review their version and consider remedial action.

The vulnerability has a CVSS score of 6.5, indicating a moderate-to-high severity. Exploitability is contingent on administrative access to the WordPress dashboard or to the specific instructor list page. No EPSS score is available, and the flaw is not listed in the CISA KEV catalog. Because the attacker must be authenticated, the attack vector is indirect and requires the attacker to have existing login credentials with sufficient privileges. Once activated, the injected queries can extract database content, but the flaw does not provide full remote code execution or denial of service.