CVE Catalog
CVE-2026-19092
CriticalCVSS 9.8Summary
The Tutor LMS WordPress plugin before version 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output.
Risk Assessment
The risk includes unauthorized execution of PHP functions, potentially leading to information disclosure or further system compromise.
Recommendation
Immediately update the Tutor LMS plugin to version 4.0.6 or later.
Original NVD description (English source)
The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output.