Exploit discussion active in current signal (3 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
The Tutor LMS plugin for WordPress is vulnerable to SQL Injection in versions up to and including 3.9.8. This is due to insufficient escaping on the 'date' parameter combined with direct interpolation into a SQL fragment before being passed to $wpdb->prepare(). This makes it possible for authenticated attackers with Admin-level access and above to append additional SQL queries and extract sensitive information from the database.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
https://atomicedge.io/cve-proof/cve-2026-6080-tutor-version-3-9-8-medium-vulnerability-proof-of-concept CVE-2026-6080 #WordPress plugin #vulnerability tutor #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge
Post summary
A link to a proof‑of‑concept for CVE‑2026‑6080 affecting Tutor plugin 3.9.8 is provided, with no indications of active exploitation, a patch, or detailed technical data.
CVE-2026-6080 The Tutor LMS plugin for WordPress is vulnerable to SQL Injection in versions up to and including 3.9.8. This is due to insufficient escaping on the 'date' parameter co… https://www.cve.org/CVERecord?id=CVE-2026-6080
Post summary
The post announces a SQL injection flaw in the Tutor LMS WordPress plugin affecting versions up to 3.9.8.
CVE-2026-6080 SQL Injection in Tutor LMS Plugin for WordPress Versions Up to 3.9.8 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-6080
Post summary
The text reports a CVE for SQL injection in Tutor LMS Plugin up to v3.9.8, but lacks PoC, exploit code, active exploitation, or patch information.