CVE-2026-22332 is an unauthenticated SQL Injection vulnerability (CWE-89) in Themeum's Tutor LMS Pro affecting all versions up to 3.9.6 inclusive. The vulnerability allows remote attackers to inject SQL commands without any authentication, resulting in a critical security risk with a CVSS 3.1 base score of 9.3. The attack vector is network-based with low attack complexity and no privileges or user interaction required. The impact includes a complete confidentiality breach and limited availability impact. No official fix or patch is currently documented, and no known exploits are reported in the wild as of the publication date.

The vulnerability allows unauthenticated remote attackers to execute arbitrary SQL commands on the affected Tutor LMS Pro installations, leading to a complete loss of confidentiality of the database contents. The integrity impact is not indicated, but availability impact is rated low, meaning some disruption may occur. This can expose sensitive user data or other critical information stored in the LMS database.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting external access to the affected Tutor LMS Pro installations and monitor for suspicious activity. Applying any available security updates from Themeum promptly once released is recommended.