CVE-2026-15444

The Tutor LMS WordPress plugin before version 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output.

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation in all versions up to, and including, 4.0.5 via the tutor_course_filter_ajax AJAX action. Missing authorization combined with unsanitized array keys passed to extract() inside tutor_load_template() allow attacker-controlled POST data to overwrite local variables and invoke arbitrary zero-argument PHP functions.

The Tutor LMS WordPress plugin before version 4.0.6 does not validate values used to build a database query and does not restrict which template file a request may load, allowing unauthenticated users to inject SQL and read question and answer content from courses that are not publicly available. The injected text reaches the query as grammar rather than as data, and on the database engines tested it does not yield extraction of arbitrary data, so the confidentiality impact is the disclosed course content rather than the database at large.

The Tutor LMS WordPress plugin before version 4.0.6 does not validate a stored file path before using it to stream media. Users with the instructor role can read arbitrary files on the server, including files outside the web root. Readable files include the WordPress configuration file, exposing database credentials and authentication keys and salts, allowing authentication cookies to be forged.

The Tutor LMS WordPress plugin before version 4.0.6 does not enforce per-object ownership checks on its course content type. This allows any user with the instructor role to read the content of private courses belonging to other instructors.

The Tutor LMS WordPress plugin before 3.9.14 does not properly verify enrollment when restricting access to protected course content. This allows authenticated users with subscriber-level access and above who are enrolled in at least one course to view paid lesson, quiz, and assignment content belonging to other courses.

The Tutor LMS plugin for WordPress up to version 4.0.0 inclusive contains a second-order SQL injection vulnerability. An authenticated attacker with custom-level access or higher can store a malicious SQL query in a quiz answer, which executes when a privileged user or REST API key holder requests the /wp-json/tutor/v1/quiz-attempt-details/{id} endpoint.

The Tutor LMS plugin for WordPress contains an authorization bypass vulnerability through a user-controlled key. This flaw allows exploiting incorrectly configured access control security levels.

The Tutor LMS WordPress plugin before version 3.9.13 fails to enforce enrollment, purchase, and private-course capability checks in its Droip and Kirki page-builder integration. This allows authenticated users with subscriber-level access to enroll in paid or private courses, read private course content, and mark arbitrary courses as completed.

The Tutor LMS WordPress plugin before version 3.9.13 fails to verify that the requesting user is allowed to edit a target post before overwriting it in one of its content-builder save handlers, authorizing the request only against an unrelated identifier. This allows authenticated users with instructor-level access to overwrite and take over any post or page on the site, including those owned by administrators.