Now officially on WordPress.org

CVE Database / CVE-2021-24182

CVE · Medium

CVE-2021-24182 — Tutor LMS – eLearning and online course solution [tutor] < 1.8.3

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2021-24182 Tutor LMS – eLearning and online course solution [tutor] < 1.8.3 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Medium 6.5 < 1.8.3 1.8.3 2021-03-15 —

CVE-2021-24182

The Tutor LMS plugin before version 1.8.3 contained a SQL injection vulnerability in the tutor_quiz_builder_get_answers_by_question AJAX action that allowed students to execute UNION-based SQL injection attacks. The flaw existed in functionality accessible through AJAX requests without proper input validation. Attackers with student-level access could exploit this weakness to query or modify the database. The vulnerability was patched in version 1.8.3.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings