Some cron job creates courses like SQL Injection

The last about 10 days, it looks like a cron job creates 5 new empty courses (not public) 3 times a day. Maybe it is an SQL Injection from some vulnerability. The administrator account is the creator, but this account is not a Tutor. I use WordPress 5.9 and Tutor LMS Pro 1.9.14.

Thank in advanced!