CVE-2024-10400

CVE-2024-10400 is an SQL injection flaw in the Tutor LMS plugin for WordPress, caused by insufficient escaping of the 'rating_filter' parameter and inadequate preparation of the underlying SQL query. An unauthenticated attacker can trigger the flaw by sending crafted input in the 'rating_filter' parameter, appending additional SQL queries to existing ones. Successful exploitation allows the attacker to extract sensitive information from the site's WordPress database, such as user details and other stored data, with no changes to data or availability. Any WordPress site running Tutor LMS version 2.7.6 or earlier is affected. No public proof-of-concept or confirmed in-the-wild exploitation is known yet, but the EPSS score of 83.1% (100th percentile) indicates a very high probability of exploitation within the next 30 days.

What to do: Update Tutor LMS to the latest release (any version newer than 2.7.6), which remediates the injection. If immediate patching is not possible, deploy a web application firewall rule or virtual patch that sanitizes or blocks untrusted input to the 'rating_filter' parameter. Review web and database logs for anomalous queries or unexpected UNION/stacked-query activity involving 'rating_filter' to check for signs of attempted exploitation.