CVE Database /
CVE-2026-10736
CVE · Medium
CVE-2026-10736 — Tutor LMS – eLearning and online course solution [tutor] < 3.9.12
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2026-10736
|
Tutor LMS – eLearning and online course solution [tutor] < 3.9.12 |
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') |
Medium
4.9
|
< 3.9.12
|
3.9.12 |
2026-06-17 |
—
|
CVE-2026-10736
The Tutor LMS plugin for WordPress contains a security flaw in versions up to 3.9.11, allowing malicious users with admin privileges or higher to inject arbitrary SQL code by manipulating the 'data' parameter. This occurs because the plugin fails to properly sanitize user input and doesn't adequately protect its database queries from tampering. As a result, attackers can exploit this vulnerability to extract sensitive data from the affected site's database.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings