CVE-2024-10400 is an SQL Injection vulnerability in the Tutor LMS plugin for WordPress, affecting all versions up to 2.7.6. The issue arises from insufficient escaping of the 'rating_filter' parameter and inadequate preparation of the SQL query, enabling unauthenticated attackers to append arbitrary SQL commands. This can be leveraged to extract sensitive data from the backend database. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

Successful exploitation allows unauthenticated attackers to perform SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability does not impact integrity or availability but compromises confidentiality. No known active exploitation has been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable parameter if possible or applying web application firewall rules to detect and block SQL Injection attempts targeting the 'rating_filter' parameter.