SQL Injection Vulnerability in Tutor LMS Plugin for WordPress

CVE-2026-10736

What is CVE-2026-10736?

The Tutor LMS plugin for WordPress is susceptible to SQL Injection through the 'data' parameter due to inadequate escaping of user-supplied data and insufficient preparation within SQL queries. This vulnerability allows authenticated attackers, who have administrator-level access or higher, to inject additional SQL commands into existing queries. Consequently, they can exploit this vulnerability to retrieve sensitive information stored in the database, posing a significant security risk.

References