CVE-2026-10736

MediumCVSS 4.9/10Last modified Jun 18, 2026

Description

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'data' parameter in all versions up to, and including, 3.9.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
themeum	Tutor LMS – eLearning and online course solution	<= 3.9.11

References

Timeline

Published: Jun 18, 2026
Last modified: Jun 18, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1073609.6A flaw was found in rubygem-safemode. Compound assignment expressions in sandboxed code are evaluated without mediating method calls through CVE-2026-1073614.2The Arkime live capture service (arkime-live) in Malcolm runs with network_mode: host, exposing port 8005 on all network interfaces (viewHos CVE-2026-1073627.1The bundled FilePond PHP server in Malcolm's file-upload component exposes a fetch route that retrieves an arbitrary URL and returns the res CVE-2026-1073636.1In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authent CVE-2026-1073655.3A user with query access to a Google Cloud Monitoring data source can use its resource proxy to send requests to other Cloud Monitoring API CVE-2026-1073668.3IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bu CVE-2026-1073696.1The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then stores this value and, in a later step, CVE-2026-107377.5The SP Project & Document Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the view_fi CVE-2026-1073705.3When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication tra CVE-2026-1073715.4When the authorize() method is called with a maxAge parameter, the auth0.js library does not validate the auth_time claim in the resulting I CVE-2026-107372The auth0-ai-js FGA retriever does not distinguish between authorization checks under different conditions when filtering documents during r CVE-2026-1073739.1ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument.