CVE-2026-15022 is a stored SQL Injection vulnerability in the Tutor LMS WordPress plugin (versions <=4.0.0). It occurs due to improper neutralization of special elements in SQL commands (CWE-89) when processing the Stored Quiz Answer Array. Authenticated attackers with custom-level access or above can submit malicious SQL payloads via the wp_ajax_tutor_quiz_abandon handler. The payload is stored and later executed when a privileged user or Tutor REST API key holder accesses the /wp-json/tutor/v1/quiz-attempt-details/{id} endpoint, constituting a second-order injection. This allows unauthorized extraction of sensitive database information. The vulnerability has a CVSS 3.1 base score of 6.5 (medium severity), with network attack vector, low attack complexity, and requires privileges but no user interaction.

Successful exploitation allows authenticated users with custom-level access or higher to inject SQL queries that execute in the context of privileged users or API key holders retrieving quiz attempt details. This can lead to unauthorized disclosure of sensitive information from the database. There is no indication of impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict custom-level user privileges to trusted users only and monitor access to the /wp-json/tutor/v1/quiz-attempt-details/{id} endpoint. Avoid exposing privileged API keys unnecessarily.