What’s Vulnerable › Vulnerabilities
CVE-2026-19092: Tutor LMS < 4.0.6 - Unauthenticated Arbitrary Zero-Argument Function Invocation via Template Variable Shadowing
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 2.6% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2026-08-27 · updated 2026-08-28
- Weakness: CWE-74
Description
The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output.
Affected products
- themeum Tutor LMS – eLearning and online course solution: from 2.1.3 before 4.0.6 — fixed in 4.0.6
How to fix
Upgrade to a fixed version: themeum Tutor LMS – eLearning and online course solution 4.0.6. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-19092 or the next vulnerability affects your stack