1Kr10S

**Name of the Vulnerable Software and Affected Versions** Tutor LMS versions prior to 3.9.12 **Description** The Tutor LMS – eLearning and online course solution plugin for WordPress contains a generic SQL Injection flaw. This occurs because of insufficient escaping of user-supplied input and a lack of proper preparation of the SQL query. Authenticated attackers with administrator-level access or higher can append additional SQL queries to existing ones via the `data` parameter to extract sensitive information from the database. **Recommendations** Update to a version newer than 3.9.11. As a temporary workaround, restrict access to the `data` parameter to minimize the risk of exploitation.