CVE-2026-22332 Unauthenticated SQL Injection in Tutor LMS Pro <= 3.9.6 versions

Description

Unauthenticated SQL Injection in Tutor LMS Pro <= 3.9.6 versions.

Affected products and versions

Product	Affected versions	Fixed in
Tutor LMS Pro 3.9	earliest → 3.9.6	No fix stated

Other CVEs of Tutor LMS Pro

The 9 CVEs of Tutor LMS Pro →

CVE-2026-25406 Authentication Bypass Using an Alternate Path or Channel vulnerability in Themeum Tutor LMS Pro tutor-pro allows… 8.1 High CVE-2026-0953 The Tutor LMS Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including,… 9.8 Critical CVE-2025-6639 The Tutor LMS Pro – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object… 5.4 Medium CVE-2025-6184 The Tutor LMS Pro – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL… 8.8 High