CVE-2026-22332

CriticalCVSS 9.3

Published: 17/06/2026(UTC)Updated: 26/10/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

21th percentile - higher than 21% of all known CVEs

Summary

There is an unauthenticated SQL injection vulnerability in Tutor LMS Pro versions up to 3.9.6.

Risk Assessment

An attacker could exploit this vulnerability to gain access to database data, potentially leading to serious security breaches.

Recommendation

It is recommended to update to the latest version of Tutor LMS Pro to mitigate this vulnerability.

Other vulnerabilities in Tutor LMS Pro

CVE-2025-6639Medium
The Tutor LMS Pro plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to and including 3.8.3 due to missing validation on a user-controlled key in the tutor_assignment_submit() function. An authenticated attacker with Subscriber-level access or above can view and edit assignment submissions of other students.

Original NVD description (English source)

Unauthenticated SQL Injection in Tutor LMS Pro <= 3.9.6 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS