CVE-2026-15022 is a stored SQL Injection vulnerability in the Tutor LMS WordPress plugin affecting all versions up to 4.0.0. The issue arises from insufficient escaping of user-supplied parameters in the stored quiz answer array and lack of proper SQL query preparation. Authenticated attackers with custom-level access or above can inject additional SQL queries during quiz attempts via the wp_ajax_tutor_quiz_abandon handler. The injected SQL executes later when privileged users or Tutor REST API key holders request the /wp-json/tutor/v1/quiz-attempt-details/{id} endpoint, enabling extraction of sensitive information from the database. There is no indication of a patch or official remediation at this time.

The vulnerability allows authenticated users with custom-level access or higher to perform stored SQL injection attacks that can extract sensitive information from the database. The confidentiality of data is impacted (high), but integrity and availability are not affected. Exploitation requires authentication and elevated privileges to trigger the injected payload, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict custom-level and higher user access to trusted users only. Monitor for suspicious activity related to quiz attempts and API access. Avoid exposing the /wp-json/tutor/v1/quiz-attempt-details/{id} endpoint to untrusted parties. Follow vendor updates for official patches or mitigations.