The Tutor LMS plugin for WordPress suffers from a time-based SQL Injection vulnerability via the 'course_id' parameter due to improper neutralization of special elements in SQL commands (CWE-89). Authenticated attackers with admin access can append malicious SQL queries to existing ones, potentially exposing sensitive data. This affects all versions up to and including 2.7.1. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official fix has been documented in the provided data.

Successful exploitation allows authenticated administrators to execute arbitrary SQL commands within the database context, potentially leading to unauthorized disclosure, modification, or deletion of sensitive data. This compromises the confidentiality, integrity, and availability of the affected system's data. The attack requires admin-level privileges, limiting the attack surface to trusted users with elevated rights.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict admin access to trusted personnel only and monitor for suspicious activity. Avoid using vulnerable versions of the Tutor LMS plugin where possible. Follow vendor channels for updates regarding patches or official mitigations.