CVE-2026-6080: 
WordPress vulnerability analysis and mitigation

CVE-2026-6080 is a SQL Injection vulnerability in the Tutor LMS plugin for WordPress, affecting versions up to and including 3.9.8. The flaw arises from insufficient escaping of the date parameter, which is directly interpolated into a SQL fragment before being passed to $wpdb->prepare(), allowing authenticated attackers with Admin-level access to extract sensitive database information. It was published on April 17, 2026, with a patch available in version 3.9.9. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Wordfence).

The root cause is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The vulnerable code resides in classes/Instructors_List.php (lines 376 and 451) and views/pages/instructors.php (line 38), where the date parameter is interpolated directly into a SQL string fragment before the query is passed to WordPress's $wpdb->prepare() function — a pattern that bypasses the intended parameterization protections. An authenticated attacker with Admin-level privileges can craft a malicious date value containing additional SQL syntax to append arbitrary queries and extract data from the WordPress database. The fix was applied in the changeset for version 3.9.9, modifying Instructors_List.php to properly escape the parameter (GitHub Advisory, WordPress Trac).

Successful exploitation allows authenticated Admin-level attackers to perform SQL injection, enabling unauthorized extraction of sensitive information from the WordPress database — including user credentials, personal data, course records, and other confidential content stored by the Tutor LMS plugin. The impact is limited to confidentiality (High), with no direct integrity or availability impact per the CVSS scoring. While the requirement for Admin-level access limits the attack surface, a compromised admin account or a malicious admin could leverage this vulnerability to exfiltrate the entire database (GitHub Advisory, Wordfence).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.014–0.018%, indicating a very low probability of exploitation in the near term. Exploitation requires authenticated Admin-level access, which significantly reduces the likelihood of opportunistic attacks.

1. Authenticate: Log in to the WordPress site with an account that has Admin-level privileges or higher.
2. Locate the vulnerable endpoint: Navigate to the Instructors management page within the Tutor LMS admin panel, which processes the date parameter via views/pages/instructors.php and classes/Instructors_List.php.
3. Craft a malicious request: Intercept or manually construct an HTTP request to the instructors page, injecting SQL syntax into the date parameter (e.g., appending UNION SELECT or stacked queries) before it is interpolated into the SQL fragment.
4. Extract database contents: The injected SQL payload is executed against the WordPress database via $wpdb->prepare(), allowing the attacker to retrieve sensitive records such as user credentials, email addresses, or other stored data.
5. Exfiltrate data: Review the application's response or use blind/time-based SQL injection techniques to extract data if output is not directly reflected (GitHub Advisory, WordPress Trac).

• Logs: WordPress or web server access logs showing unusual or malformed values in the date parameter on requests to the Tutor LMS instructors admin page (e.g., values containing SQL keywords like UNION, SELECT, --, or encoded equivalents).
• Database: Unexpected or anomalous database queries in MySQL slow query logs or general query logs originating from the WordPress application user, particularly involving UNION SELECT or stacked query patterns.
• Network: Repeated or automated requests to the Tutor LMS instructors endpoint from a single authenticated session, potentially indicating automated SQL injection tooling (e.g., sqlmap).
• Application: Unusual data appearing in admin-facing responses or error messages that may reflect database content not normally surfaced in the UI.

The primary remediation is to update the Tutor LMS plugin to version 3.9.9 or later, which includes the fix applied in the Instructors_List.php changeset (WordPress Trac). For organizations unable to update immediately, restrict Admin-level access to the WordPress site to only trusted and necessary personnel, and monitor database access logs for anomalous SQL query patterns. A Web Application Firewall (WAF) with SQL injection detection rules can provide an additional layer of defense as a temporary measure (Wordfence).

Wordfence included CVE-2026-6080 in its weekly WordPress vulnerability report for April 13–19, 2026, noting the SQL injection risk in Tutor LMS (Wordfence Blog). Sucuri also referenced the vulnerability in its April 2026 vulnerability patch roundup (Sucuri Blog). No significant social media controversy or broader community debate has been observed, consistent with the moderate severity and limited exploitability of the vulnerability.