CVE-2024-1751 is a time-based SQL Injection vulnerability in the Tutor LMS WordPress plugin, specifically via the question_id parameter. The issue arises from improper neutralization of special elements in SQL commands due to insufficient escaping and lack of prepared statements. Authenticated attackers with subscriber or higher roles can append malicious SQL queries to extract sensitive data from the backend database. The vulnerability affects all versions up to and including 2.6.1 and has a CVSS 3.1 score of 8.8, reflecting high severity with network attack vector, low attack complexity, and no user interaction required.

Successful exploitation allows authenticated users with subscriber or higher privileges to perform time-based SQL Injection attacks, potentially leading to unauthorized disclosure of sensitive database information, modification of data, and disruption of service. The vulnerability impacts confidentiality, integrity, and availability of the affected system. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level access where possible and monitor for suspicious activity related to SQL queries involving the question_id parameter. Avoid exposing the vulnerable plugin on publicly accessible sites or consider disabling the plugin temporarily if feasible.