Access violation vulnerability in Tutor LMS Pro 2.7.0

The Tutor LMS Pro plugin for WordPress has a security issue that could allow someone to access, change, or delete data without permission. This is because the plugin does not have a check in place to make sure only authorized users have access to the ‘get_calendar_materials’ function. Additionally, the plugin is vulnerable to a type of attack called SQL Injection, where an attacker could add their own code into the plugin’s existing code to access confidential information from the database. This could be done by someone with subscriber-level permissions or higher.