Tutor LMS CVE-2026-10736

Exploitation requires a valid WordPress user account with administrator-level role (or higher, e.g., Super Admin on multisite). The vulnerability is triggered through the Tutor LMS withdrawal-request management interface, meaning the Tutor LMS plugin must be installed, active, and the attacker must interact specifically with the withdrawal/payout administrative view. The 'data' parameter must be submitted to the affected endpoint in WithdrawModel.php. These conditions limit exploitation: unauthenticated or subscriber/contributor/editor-level users cannot reach this code path. The non-default requirement of administrator access is the primary real-world limiting factor beyond the standard network-accessible WordPress admin panel. No specific server configuration or non-default WordPress setting is required beyond the plugin being installed.

The CVSS base score of 4.9 with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N accurately reflects the attack prerequisites: the vulnerability is network-reachable but requires administrator-level credentials (PR:H), which substantially limits the attacker pool. The scope is unchanged (S:U), and impact is confidentiality-only (I:N/A:N), meaning database exfiltration is possible but the attacker cannot write data or cause denial of service through this vector alone. No EPSS score was provided in the source data, so quantitative exploitation-probability cannot be stated. The vulnerability is not in CISA KEV and no public proof-of-concept has been identified, placing this firmly in the 'no public exploit identified at time of analysis' tier. Real-world priority is moderate: on a multi-tenant WordPress environment or managed hosting platform where administrator credentials may be shared or weakly controlled, database exfiltration of user PII, course data, or financial records is a credible threat. On tightly controlled single-site installs, the admin-only requirement is a meaningful limiting factor. No conflicting signals exist between the CVSS vector and the description.

An attacker with valid WordPress administrator credentials logs into the wp-admin panel and navigates to the Tutor LMS withdrawal-requests management interface. By submitting a crafted value in the 'data' parameter - exploiting the lack of parameterized queries in WithdrawModel.php - the attacker appends a UNION- or stacked-query payload to extract arbitrary table contents, including WordPress user password hashes, email addresses, private course data, and stored payment information. No public proof-of-concept has been identified at time of analysis, but the technique is standard SQL injection requiring no specialized tooling.