CVE-2024-4902 is a high severity time-based SQL injection in the Tutor LMS WordPress plugin through version 2.7.1, scored 7.2. The course_id parameter is not escaped. Administrators can run extra queries, so update to a release after 2.7.1.
What's affected
Per the record, all Tutor LMS versions up to and including 2.7.1 are affected. The plugin is published by Themeum. The description names the course_id parameter, with insufficient escaping and no prepared statement around the existing query.
It also says CVE-2024-37256 "is likely a duplicate of this issue", so you may see both IDs in scanner output for the same finding.
Fixed version: the references are a WordPress plugin repository browser link and a changeset, plus a Wordfence page that returned no content to me. The affected range implies the fix is after 2.7.1, but I could not confirm the exact release. Check the plugin's changelog on WordPress.org.
The vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. It needs an administrator account, which keeps the score at 7.2. The class is CWE-89, SQL injection.
How to check if you're exposed
With WP-CLI:
wp plugin list --name=tutor --fields=name,status,version
Or open Plugins in the WordPress dashboard and read the version beside Tutor LMS. Do this for every site, including staging copies and sites that agencies host for you. If the version is 2.7.1 or lower, the plugin is in scope.
Next, list administrator accounts, since exploitation requires one:
wp user list --role=administrator --fields=ID,user_login,user_email
What to do now
- Find every WordPress site that runs Tutor LMS.
- Update the plugin to the latest release and confirm in the changelog that it is newer than 2.7.1.
- Remove or demote administrator accounts that do not need that role, and enforce strong passwords and two factor authentication.
- Back up the database before updating, as is usual for a major plugin change.
- Check for admin accounts you do not recognize and for unusual slow queries in the database log.
Why it matters
SQL injection happens when user supplied text becomes part of a query. In a time-based case the attacker reads data by making the database pause and measuring response times, which is slow but works without visible output. The description says the technique could extract sensitive information from the database.
On a learning site that data can include student records, course content and the WordPress user table with password hashes. The administrator requirement narrows the audience, but admin accounts on shared WordPress sites are often held by several contributors, and one stolen password is enough.
The record does not mark this CVE as exploited in the wild and it is not in the CISA KEV catalog.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do attackers need to be logged in?
Yes, as an administrator or higher, according to the description.
Is CVE-2024-37256 a different bug?
The record calls it likely a duplicate, so treat them as one finding.
Sources
- Plugin source reference
- Wordfence entry (page returned no content)
Last reviewed: 19 October 2026.
