CVE-2025-6184 in Tutor LMS Pro Plugin
Summary
by MITRE • 08/13/2025
The Tutor LMS Pro – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter used in the get_submitted_assignments() function in all versions up to, and including, 3.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Tutor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Only the Pro version is affected.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/13/2025
The vulnerability identified as CVE-2025-6184 affects the Tutor LMS Pro plugin for WordPress, specifically targeting versions up to and including 3.7.0. This represents a critical security flaw that exploits a time-based SQL injection vulnerability within the plugin's get_submitted_assignments() function. The issue arises from inadequate input sanitization and improper SQL query preparation mechanisms, creating a pathway for malicious actors to manipulate database queries through crafted input parameters.
The technical exploitation occurs through the 'order' parameter which is processed within the get_submitted_assignments() function without proper escaping or parameterization. This vulnerability falls under CWE-89, which specifically addresses SQL injection flaws where untrusted data is incorporated into SQL commands without adequate sanitization. Attackers with Tutor-level access or higher can leverage this weakness to append additional SQL commands to existing queries, effectively bypassing normal database access controls and potentially extracting sensitive information from the underlying database system.
The operational impact of this vulnerability extends beyond simple data theft, as it enables authenticated attackers to perform unauthorized database operations that could compromise the integrity and confidentiality of educational platform data. Since this affects only the Pro version of the plugin, organizations running the free version remain unaffected, but those utilizing the premium features face significant risk. The time-based nature of the injection means that attackers can infer database contents through timing variations in query responses, making detection more challenging and allowing for stealthy data exfiltration operations.
Mitigation strategies should prioritize immediate patching of the affected plugin versions to the latest secure releases where the SQL injection vulnerability has been addressed through proper input validation and parameterized query construction. Organizations should also implement network-level monitoring to detect unusual database query patterns that might indicate exploitation attempts. Additionally, following the principle of least privilege by restricting administrative access to only necessary personnel and implementing robust database access controls can significantly reduce the potential impact of such vulnerabilities. The ATT&CK framework categorizes this as a database access technique under the credential access and persistence domains, emphasizing the need for comprehensive security measures beyond simple patch management.