CVE-2026-19092

The Tutor LMS WordPress plugin before 4.0.6 fails to prevent request data (e.g., crafted request parameters) from overwriting internal variables while rendering templates, a flaw tracked as CWE-74 (injection). An unauthenticated attacker can exploit this remotely over the network by sending requests whose parameters name and overwrite template variables, causing the plugin to invoke arbitrary PHP functions that take no arguments and return the functions' output to the attacker. Depending on the functions callable in the context, this can disclose sensitive server or configuration information and, per the critical 9.8 CVSS 3.1 score (C:H/I:H/A:H), can have high impact on confidentiality, integrity, and availability. Any WordPress site running an affected version of Tutor LMS is exposed, particularly where the plugin's front-end endpoints are reachable by anonymous visitors. As of now there is no known public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS estimates a 1.5% probability of exploitation in the next 30 days (73rd percentile).

What to do: Upgrade Tutor LMS to version 4.0.6 or later. If patching is delayed, restrict unauthenticated access to the plugin's template-rendering endpoints (e.g., via WAF rules or access controls) and review access logs for requests supplying unusual parameter names or values that look like PHP function names. No public exploit is known, but the critical severity justifies prioritizing the update.