The Tutor LMS Pro plugin for WordPress contains an SQL injection vulnerability (CWE-89) due to improper neutralization of special elements in SQL commands within the 'authenticate' function. This flaw results from a missing capability check, enabling authenticated users with low-level permissions (subscriber and above) to escalate privileges and take over administrator accounts. The vulnerability affects all versions up to and including 2.7.0. The CVSS 3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, and no user interaction required. The vulnerability impacts confidentiality, integrity, and availability.

Exploitation of this vulnerability allows authenticated attackers with subscriber-level permissions or higher to gain control of administrator accounts. This can lead to unauthorized access to sensitive data, modification or deletion of data, and potential full compromise of the affected WordPress site. The high CVSS score reflects the critical impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user permissions to trusted users only and monitor for suspicious activity related to privilege escalation. Avoid granting subscriber-level or higher permissions to untrusted users. Follow updates from the vendor (themeum) for an official patch or temporary mitigation.