CVE-2026-6080

CVE-2026-6080 is a SQL Injection vulnerability affecting the Tutor LMS plugin for WordPress through version 3.9.8, caused by insufficient escaping of the 'date' parameter before SQL query execution. Authenticated attackers with Admin-level privileges or higher can exploit this flaw to inject malicious SQL commands and extract sensitive data from the affected database. The vulnerability carries a CVSS score of 6.5 (Medium severity) with a network-based attack vector requiring low complexity and low privilege escalation. While the attack requires user authentication and administrator-level access, successful exploitation could result in high-impact confidentiality breaches, though integrity and availability are not directly affected. The vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities catalog and shows minimal exploitation activity in the wild, with an EPSS score of 0.00016 indicating very low probability of active exploitation. No publicly available exploit code has been identified, and community attention remains low based on available threat intelligence indicators.