CVE-2026-10736

Name of the Vulnerable Software and Affected Versions Tutor LMS versions prior to 3.9.12

Description The Tutor LMS – eLearning and online course solution plugin for WordPress contains a generic SQL Injection flaw. This occurs because of insufficient escaping of user-supplied input and a lack of proper preparation of the SQL query. Authenticated attackers with administrator-level access or higher can append additional SQL queries to existing ones via the data parameter to extract sensitive information from the database.

Recommendations Update to a version newer than 3.9.11. As a temporary workaround, restrict access to the data parameter to minimize the risk of exploitation.