WordPress插件Tutor LMS认证管理员SQL注入漏洞(CVE-2026-15444)公告

漏洞概述 漏洞名称: Tutor LMS <= 4.0.1 - Authenticated (Administrator+) SQL Injection via 'coupon_code' Parameter CVE ID: CVE-2026-15444 CVSS评分: 4.9 (Medium) 发布日期: July 27, 2026 最后更新日期: July 28, 2026 研究者: Wordfence PRISM - Wordfence 影响范围 软件类型: Plugin 软件名称: Tutor LMS - eLearning and online course solution 受影响版本: <= 4.0.1 修复版本: 4.0.2 修复方案 修复建议: 更新到版本 4.0.2 或更新的已修复版本。 其他信息 漏洞描述: Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'coupon_code' parameter in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. 相关漏洞 近期漏洞: - Tutor LMS <= 4.0.0 - Authenticated (Subscriber+) SQL Injection via Stored Quiz Answer Array - Tutor LMS - eLearning and online course solution <= 3.9.13 - Unauthenticated Insecure Direct Object Reference - Tutor LMS <= 3.9.11 - Authenticated (Author+) Stored Cross-Site Scripting via Lesson Attachment Title - Tutor LMS <= 3.9.11 - Authenticated (Administrator+) SQL Injection via data/ Parameter - Tutor LMS <= 3.9.9 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Post Deletion via Course GET Parameter - Tutor LMS - eLearning and online course solution <= 3.9.7 - Missing Authorization - Tutor LMS <= 3.9.8 - Authenticated (Admin+) SQL Injection via 'date' Parameter - Tutor LMS <= 3.9.8 - Authenticated (Subscriber+) Arbitrary Course Content Manipulation via tutor_update_course_content_order - Tutor LMS <= 3.9.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Course Content Modification - Tutor LMS <= 3.9.7 - Missing Authorization to Authenticated (Subscriber+) Unauthorized Private Course Enrollment 参考链接 plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org 分享 Facebook Twitter LinkedIn Email 其他 业务时间: 9am-8pm ET, 6am-5pm PT and 2pm-1am UTC/GMT excluding weekends and holidays. 响应时间: 24-hour support, 365 days a year, with a 1-hour response time. 版权信息 版权: © 2012-2026 Defiant Inc. All Rights Reserved 联系方式 邮箱: wf-support@wordfence.com 其他链接 Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information 社交媒体 X Facebook Instagram YouTube 产品 Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central 支持 Documentation Learning Center Free Support Premium Support 新闻 Blog In The News Vulnerability Advisories 关于 About Wordfence Affiliate Program Employment Contact Security CVE Request Form 订阅 订阅: Sign up for news and updates from our panel of experienced security professionals. 邮箱: you@example.com 同意条款: By checking this box I agree to the terms of service and privacy policy. 注册 按钮: SIGN UP 其他 业务时间: 9am-8pm ET, 6am-5pm PT and 2pm-1am UTC/GMT excluding weekends and holidays. 响应时间: 24-hour support, 365 days a year, with a 1-hour response time. 版权信息 版权: © 2012-2026 Defiant Inc. All Rights Reserved 联系方式 邮箱: wf-support@wordfence.com 其他链接 Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information 社交媒体 X Facebook Instagram YouTube 产品 Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central 支持 Documentation Learning Center Free Support Premium Support 新闻 Blog In The News Vulnerability Advisories 关于 About Wordfence Affiliate Program Employment Contact Security CVE Request Form 订阅 订阅: Sign up for news and updates from our panel of experienced security professionals. 邮箱: you@example.com 同意条款: By checking this box I agree to the terms of service and privacy policy. 注册 按钮: SIGN UP 其他 业务时间: 9am-8pm ET, 6am-5pm PT and 2pm-1am UTC/GMT excluding weekends and holidays. 响应时间: 24-hour support, 365 days a year, with a 1-hour response time. 版权信息 版权: © 2012-2026 Defiant Inc. All Rights Reserved 联系方式 邮箱: wf-support@wordfence.com 其他链接 Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information 社交媒体 X Facebook Instagram YouTube 产品 Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central 支持 Documentation Learning Center Free Support Premium Support 新闻 Blog In The News Vulnerability Advisories 关于 About Wordfence Affiliate Program Employment Contact Security CVE Request Form 订阅 订阅: Sign up for news and updates from our panel of experienced security professionals. 邮箱: you@example.com 同意条款: By checking this box I agree to the terms of service and privacy policy. 注册 按钮: SIGN UP 其他 业务时间: 9am-8pm ET, 6am-5pm PT and 2pm-1am UTC/GMT excluding weekends and holidays. 响应时间: 24-hour support, 365 days a year, with a 1-hour r

目标达成感谢每一位支持者 — 我们达成了 100% 目标！

WordPress插件Tutor LMS认证管理员SQL注入漏洞(CVE-2026-15444)公告

同源更多文章

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

WordPress插件Tutor LMS认证管理员SQL注入漏洞(CVE-2026-15444)公告

同源更多文章

目标达成感谢每一位支持者 — 我们达成了 100% 目标！