CVE-2026-22332
Deferred Deferred - Pending Action
Unauthenticated SQL Injection in Tutor LMS Pro

Publication date: 2026-06-17

Last updated on: 2026-06-17

Assigner: Patchstack

Description
Unauthenticated SQL Injection in Tutor LMS Pro <= 3.9.6 versions.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-17
Last Modified
2026-06-17
Generated
2026-06-17
AI Q&A
2026-06-17
EPSS Evaluated
N/A
NVD
CVE-2026-22332
EUVD
EUVD-2026-37655
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
themeum tutor_lms_pro to 3.9.6 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Compliance Impact

The vulnerability allows unauthenticated SQL Injection, which could enable attackers to steal sensitive information from the website's database.

Such unauthorized access and potential data breach could lead to non-compliance with data protection regulations like GDPR and HIPAA, which require safeguarding sensitive personal and health information.

Failure to protect against this vulnerability may result in violations of these standards due to exposure of confidential data.

Executive Summary

CVE-2026-22332 is an unauthenticated SQL Injection vulnerability found in Tutor LMS Pro versions 3.9.6 and earlier. This flaw allows attackers to directly interact with the website's database without needing to log in or have any privileges.

The vulnerability is classified under the OWASP Top 10 category A3: Injection, which is known for being highly dangerous and commonly exploited.

Because it is unauthenticated, attackers can exploit this vulnerability remotely and easily, making it a critical security risk.

Impact Analysis

This vulnerability can have severe impacts including unauthorized access to sensitive data stored in the website's database.

Attackers could steal confidential information, potentially leading to data breaches.

Additionally, the vulnerability has a high likelihood of being exploited in widespread attacks targeting many websites, increasing the risk of compromise.

The vulnerability also has a CVSS score of 9.3, indicating critical severity with high confidentiality impact and low attack complexity.

Mitigation Strategies

The immediate step to mitigate this vulnerability is to update the Tutor LMS Pro plugin to version 3.9.7 or later, as this version contains the patch for the SQL Injection flaw.

Until the update can be applied, it is recommended to implement the mitigation rule provided by Patchstack to block attacks targeting this vulnerability.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-22332. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart