CVE-2026-10736: Tutor LMS SQL Injection – Authenticated Data Breach Risk

Technical summary

CVE-2026-10736 is a SQL injection vulnerability (CWE-89) in the Tutor LMS WordPress plugin affecting all versions through 3.9.11. The vulnerability exists due to insufficient input escaping and lack of prepared statement usage on the 'data' parameter. An attacker with administrator privileges can craft malicious SQL statements to query the database directly, potentially exfiltrating sensitive data such as user credentials, course information, or other stored records. The CVSS 3.1 score of 4.9 (MEDIUM) reflects high confidentiality impact but no integrity or availability risk, and the requirement for high-privilege authentication.

Business impact

For WordPress sites running Tutor LMS, this vulnerability poses a data breach risk if an administrator account is compromised or if a malicious insider with admin access is present. The threat is primarily to confidentiality—attackers can read sensitive database contents including student records, payment information, and enrolled course data. Organizations relying on Tutor LMS for course delivery and user management should assess whether internal administrators are trustworthy and whether database access controls are properly segregated from the web application.

Affected systems

All Tutor LMS plugin versions up to and including 3.9.11 are vulnerable. The affected systems are WordPress installations with the Tutor LMS plugin active. Organizations using this plugin for learning and course delivery are in scope. Exposure is limited to sites where administrator accounts exist and could be compromised or misused.

Exploitability

Exploitation requires valid WordPress administrator credentials, making this a privilege-escalation or insider-threat scenario rather than an easy remote attack. No public exploit code or active exploitation in the wild has been reported. An attacker would need either stolen admin credentials, a compromised admin account, or insider malicious intent. The attack is non-interactive (no user interaction required once authenticated) and works over the network, but the authentication barrier significantly reduces practical exploitability for external threat actors.

Remediation

Update the Tutor LMS plugin to the latest patched version (verify against the vendor advisory for the specific version number addressing this CVE). After patching, audit admin account activity and credentials. Consider implementing least-privilege principles for administrator roles and monitoring database queries for anomalous SQL patterns. For organizations unable to patch immediately, restrict administrator account creation and monitor admin panel access logs closely.

Patch guidance

Check the WordPress plugin repository or Tutor LMS official documentation for the patched version that addresses CVE-2026-10736. Apply updates through the standard WordPress plugin update interface or manually if required. Test the update in a staging environment first to ensure compatibility with active courses and student data. After patching, confirm the plugin version number in the WordPress admin dashboard. If the vendor has not yet released a patch, consider temporarily disabling the plugin if it is not critical to operations, or isolating the database with network-level access controls.

Detection guidance

Monitor WordPress admin logs for unusual database queries or multiple login attempts by administrators. Use WordPress security plugins or log monitoring tools to flag SQL-like patterns in POST request parameters, especially those containing 'data' parameter values with SQL keywords. Audit admin user accounts for unauthorized creations or suspicious last-login timestamps. Check database query logs (if available) for UNION-based or time-based injection patterns. Review administrator activity for bulk data exports or unusual query execution times that may indicate data exfiltration attempts.

Why prioritize this

This vulnerability should be prioritized based on the sensitivity of data stored in the Tutor LMS database (student records, enrollments, potentially payment information) and the trustworthiness of administrator accounts in your environment. If your WordPress site has multiple administrators or shared hosting environments, the risk increases. However, compared to unauthenticated remote code execution vulnerabilities, this is lower priority. Prioritize if you have high-value course data, regulatory compliance obligations (GDPR, FERPA for student records), or known admin account security incidents.

Risk score, explained

The CVSS 3.1 score of 4.9 (MEDIUM) reflects a vulnerability with high confidentiality impact but requiring high-privilege authentication (PR:H), no integrity or availability damage (I:N/A:N), and network accessibility (AV:N/AC:L/UI:N). The high-privilege requirement substantially reduces the base risk compared to unauthenticated SQL injection attacks. The score is appropriate for a data-exfiltration risk limited to authenticated insiders or compromised admin accounts.

Frequently asked questions