CVE-2025-6184

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-6184", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-06-16T18:24:38.972Z", "datePublished": "2025-08-13T06:39:49.597Z", "dateUpdated": "2026-04-08T16:50:57.980Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:50:57.980Z"}, "affected": [{"vendor": "themeum", "product": "Tutor LMS Pro", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.7.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Tutor LMS Pro \u2013 eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the \u2018order\u2019 parameter used in the get_submitted_assignments() function in all versions up to, and including, 3.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Tutor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Only the Pro version is affected."}], "title": "Tutor LMS Pro \u2013 eLearning and online course solution <= 3.7.0 - Authenticated (Tutor Instructor+) SQL Injection", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4b41d134-be9e-469f-b26b-ac30d95db0a3?source=cve"}, {"url": "https://tutorlms.com/"}, {"url": "https://wordpress.org/plugins/tutor/#developers"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "cweId": "CWE-89", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Sergio Frami\u00f1\u00e1nn Garc\u00eda"}], "timeline": [{"time": "2025-08-01T19:13:28.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-08-12T18:27:44.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-08-13T13:28:45.512356Z", "id": "CVE-2025-6184", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-13T13:28:50.513Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-6184", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-08-13T13:28:45.512356Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-13T13:28:47.688Z"}}], "cna": {"title": "Tutor LMS Pro \u2013 eLearning and online course solution <= 3.7.0 - Authenticated (Tutor Instructor+) SQL Injection", "credits": [{"lang": "en", "type": "finder", "value": "Sergio Frami\u00f1\u00e1nn Garc\u00eda"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "themeum", "product": "Tutor LMS Pro", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.7.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-08-01T19:13:28.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-08-12T18:27:44.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4b41d134-be9e-469f-b26b-ac30d95db0a3?source=cve"}, {"url": "https://tutorlms.com/"}, {"url": "https://wordpress.org/plugins/tutor/#developers"}], "descriptions": [{"lang": "en", "value": "The Tutor LMS Pro \u2013 eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the \u2018order\u2019 parameter used in the get_submitted_assignments() function in all versions up to, and including, 3.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Tutor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Only the Pro version is affected."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:50:57.980Z"}}}, "cveMetadata": {"cveId": "CVE-2025-6184", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:50:57.980Z", "dateReserved": "2025-06-16T18:24:38.972Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-08-13T06:39:49.597Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Tutor LMS Pro", "vendor": "themeum", "versions": [{"lessThanOrEqual": "3.7.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Tutor LMS Pro \u2013 eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the \u2018order\u2019 parameter used in the get_submitted_assignments() function in all versions up to, and including, 3.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Tutor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Only the Pro version is affected."}, {"lang": "es", "value": "El complemento Tutor LMS Pro \u2013 eLearning and online course solution para WordPress es vulnerable a la inyecci\u00f3n SQL basada en tiempo a trav\u00e9s del par\u00e1metro \"order\" utilizado en la funci\u00f3n get_submitted_assignments() en todas las versiones hasta la 3.7.0 incluida, debido a un escape insuficiente del par\u00e1metro proporcionado por el usuario y a la falta de preparaci\u00f3n de la consulta SQL existente. Esto permite a atacantes autenticados, con acceso de nivel Tutor o superior, a\u00f1adir consultas SQL adicionales a consultas ya existentes que pueden utilizarse para extraer informaci\u00f3n confidencial de la base de datos. Solo la versi\u00f3n Pro se ve afectada."}], "id": "CVE-2025-6184", "lastModified": "2026-06-17T10:01:20.540", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-6184", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-08-13T13:28:45.512356Z", "version": "2.0.3"}}]}, "published": "2025-08-13T07:15:27.660", "references": [{"source": "security@wordfence.com", "url": "https://tutorlms.com/"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/tutor/#developers"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4b41d134-be9e-469f-b26b-ac30d95db0a3?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T00:56:17.502543+00:00", "value": {"mitigation_remediation": ["Upgrade Tutor LMS Pro to version 3.8 or newer, which removes the vulnerable code path", "If an upgrade is not immediately possible, restrict access so that only trusted users have Tutor Instructor+ role", "Monitor logs for suspicious SQL activity"], "summary": {"action": "Immediate Patch", "impact": "Sensitive Data Exposure"}, "threat_synthesis": {"affected_systems": "WordPress sites using the Tutor LMS Pro plugin, version 3.7.0 or earlier, including the 3.7.0 release. Only the Pro edition is affected; the free version is not vulnerable.", "description_and_impact": "The plugin contains a time\u2011based SQL Injection flaw in the order parameter of the get_submitted_assignments() function. Because the value is concatenated directly into an SQL statement without proper escaping or parameterization, an attacker who can log in as a Tutor Instructor or higher can append malicious SQL to the query. This allows unauthorized extraction of arbitrary data from the database, effectively compromising confidentiality and potentially enabling further exploitation if the database contains sensitive user or system information.", "risk_and_exploitability": "The CVSS v3 score of 8.8 indicates high severity, while the EPSS score of less than 1% suggests that the likelihood of exploitation is low at the time of this analysis. However, the vulnerability is included for authenticated users with Tutor Instructor+ privileges, a role that many course administrators possess. The flaw is not listed in the CISA KEV catalog, but the nature of the SQL injection remains a critical concern for any site that handles sensitive data through this plugin."}}}}, "created": "2025-08-13T21:47:02.860207+00:00", "updated": "2026-04-22T01:00:04.366929+00:00", "vendors": ["themeum", "themeum$PRODUCT$tutor_lms", "wordpress", "wordpress$PRODUCT$wordpress"]}