CVE-2026-6080 is an SQL Injection vulnerability in the Tutor LMS plugin for WordPress, affecting versions up to and including 3.9.8. The issue arises from insufficient escaping of the 'date' parameter, which is directly interpolated into a SQL fragment before being passed to $wpdb->prepare(). This improper neutralization of special elements (CWE-89) enables authenticated attackers with Admin-level access or higher to append arbitrary SQL queries, potentially exposing sensitive database information. The vulnerability is network exploitable with low attack complexity and does not require user interaction.

An attacker with Admin-level privileges can exploit this vulnerability to execute unauthorized SQL queries, leading to the disclosure of sensitive information from the database. The vulnerability does not impact availability or integrity directly but compromises confidentiality. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Admin-level access to trusted users only and monitor for suspicious activity related to database queries involving the 'date' parameter. Avoid using vulnerable versions of the Tutor LMS plugin if possible.