CVE-2026-10736 describes an SQL Injection vulnerability in the Tutor LMS WordPress plugin affecting all versions up to and including 3.9.11. The issue arises from insufficient escaping and lack of proper preparation of the 'data' parameter in SQL queries. Authenticated attackers with administrator or higher privileges can append arbitrary SQL queries to existing ones, potentially extracting sensitive data from the database. The vulnerability has a CVSS 3.1 base score of 4.9 (medium severity), with network attack vector, low attack complexity, high privileges required, no user interaction, and impact limited to confidentiality. No vendor advisory or patch information is provided, and no known exploits are reported in the wild.

An attacker with administrator-level access can exploit this vulnerability to perform SQL Injection via the 'data' parameter, allowing unauthorized reading of sensitive database information. The integrity and availability of the system are not impacted according to the CVSS vector. The vulnerability does not require user interaction but does require high privileges, limiting the attack surface to trusted users with elevated rights.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator-level access to trusted personnel only and monitor for suspicious activity related to SQL query manipulation. Avoid using vulnerable versions in sensitive environments if possible.