Vulnerability record · CVE-2024-10400 · published 21 November 2024
CVE-2024-10400: Tutor LMS WordPress plugin unauthenticated SQL injection via rating_filter
Themeum · Tutor Lms
The Tutor LMS plugin for WordPress fails to escape the 'rating_filter' parameter and does not prepare its SQL query, allowing SQL injection in all versions up to and including 2.7.6. Because the flaw is reachable without authentication, any remote visitor can inject SQL into existing queries and read data from the site's database.
Description
The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via the ‘rating_filter’ parameter in all versions up to, and including, 2.7.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Automated analysis
high priorityUnauthenticated network-reachable SQL injection with high confidentiality impact and a very high EPSS score, though no KEV listing or confirmed in-the-wild exploitation is documented.
What it is
The Tutor LMS plugin for WordPress fails to escape the 'rating_filter' parameter and does not prepare its SQL query, allowing SQL injection in all versions up to and including 2.7.6. Because the flaw is reachable without authentication, any remote visitor can inject SQL into existing queries and read data from the site's database.
Impact
An attacker can extract sensitive information from the WordPress database, including user and course data, without any credentials. The CVSS vector shows high confidentiality impact with no integrity or availability impact.
Attack surface
Reached over the network through the plugin's rating_filter parameter; the CVSS vector is AV:N/AC:L/PR:N/UI:N, so no authentication and no user interaction are required.
Exploitation
Not listed in CISA KEV and no public exploit references are tagged, but EPSS is 0.8312 (99.7th percentile), indicating a high modeled likelihood of exploitation. A patch reference exists, so unpatched sites remain exposed.
What to do
- Update Tutor LMS to a version newer than 2.7.6, which contains the fix in changeset 3186319.
- If immediate patching is not possible, disable the Tutor LMS plugin until it can be updated.
- Deploy a web application firewall rule blocking SQL injection patterns in the rating_filter parameter.
- Restrict database account privileges used by WordPress to limit what injected queries can read.
- Audit the site for signs of prior exploitation before and after patching.
Detection
- Review web server and WAF logs for requests containing SQL syntax or UNION/OR patterns in the rating_filter parameter.
- Monitor database query logs for unexpected SELECT statements or schema enumeration originating from the web tier.
- Check for anomalous outbound or database access patterns consistent with bulk data extraction from WordPress tables.
- Compare plugin version inventory against 2.7.6 to identify unpatched instances.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2024-10400 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2024-10400), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
