CVE-2026-15444: The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'coupon_code' parameter in all versions up to, and includin
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'coupon_code' parameter in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Details
Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-15444
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-154440.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 21% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-15444 | coverage & exploitation status | NVD · CVE.org |
Recent advisories for Tutor LMS
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- mediumCVE-2026-14310: The Tutor LMS WordPress plugin before 4.0.0 does not properly verify that a user has access to…nvd · 2026-07-30
- mediumCVE-2026-1372: The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Missing Authorization in a…nvd · 2026-07-21
- mediumCVE-2026-15022: The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to gen…nvd · 2026-07-16
- mediumCVE-2026-57694: Authorization Bypass Through User-Controlled Key vulnerability in Themeum Tutor LMS tutor allo…nvd · 2026-07-13
- highCVE-2026-12275: The Tutor LMS WordPress plugin before 3.9.13 does not, in its Droip and Kirki page-builder int…nvd · 2026-07-13
- mediumCVE-2026-12274: The Tutor LMS WordPress plugin before 3.9.13 does not verify that the requesting user is allow…nvd · 2026-07-13
More from NVD Recent CVEs
- mediumCVE-2026-18573: A flaw was found in the keycloak-services component of Keycloak, which is used for managing au…2026-08-02
- mediumCVE-2026-18572: Keycloak provides authorization services that allow administrators to restrict access to resou…2026-08-02
- mediumCVE-2026-18571: A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permission…2026-08-02
- mediumCVE-2026-18570: A flaw was found in the full-scope-disabled client-policy executor within the keycloak-service…2026-08-02
- unknownCVE-2026-16540: The Simply Schedule Appointments WordPress plugin before 1.6.12.6 does not correctly restrict …2026-08-02